Critical severity9.8NVD Advisory· Published Oct 18, 2026

CVE-2026-111998

Description

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Vanus Labs/vanusllm-create
Range: 0.8.0-0.9.0

Patches

Vulnerability mechanics

References

github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.gonvd
github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.gonvd
github.com/vanus-labs/vanus/issues/647nvd
www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-default-admin-credentials-via-gatewaynvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000