Live › vulnerability › CVE-2026-111998
Go to dashboardVanus 0.8.0 through 0.9.0 creates a default user whose token is the literal string 'admin', bound to ClusterAdmin. Anyone who can reach the gateway gRPC port can send 'Authorization: Bearer admin' and manage namespaces, eventbuses, users, tokens and role bindings, and read or publish events. The gRPC client also allows cleartext transport. There is no fixed release: the upstream issue #647 is open and v0.9.0 is the latest release. The same issue lists related flaws: unauthenticated event publish on the gateway HTTP port 8081, SSRF through subscription sinks, and missing authorization on streaming RPCs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| vanus | vendor | >= 0.8.0, <= 0.9.0 | – |
0.8.0-0.9.0 (kubectl get pods -A -o jsonpath={..image} and look for vanus images)authorization: Bearer admin <gateway>:8080 list (port is deployment-specific, check the gateway Service)admin user and token, which I could not confirm from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
This page as .md · .json · in your agent: get_signal("CVE-2026-111998")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.