---
id: "CVE-2026-111998"
kind: "vulnerability"
aliases: ["CVE-2026-111998"]
title: "Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "vanus", "fixed": [], "affected": ">= 0.8.0, <= 0.9.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["default-credentials", "grpc", "hardcoded-token", "kubernetes", "package", "self-hosted", "vanus"]
not_affected_if: ["default-config", "gateway-not-exposed", "not-network-reachable"]
published_at: "2026-10-18T12:17:11+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-23T23:27:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111998", "first_seen_at": "2026-10-23T21:57:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:27:43+00:00"}]
---

# Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers…

Vanus 0.8.0 through 0.9.0 creates a default user whose token is the literal string 'admin', bound to ClusterAdmin. Anyone who can reach the gateway gRPC port can send 'Authorization: Bearer admin' and manage namespaces, eventbuses, users, tokens and role bindings, and read or publish events. The gRPC client also allows cleartext transport. There is no fixed release: the upstream issue #647 is open and v0.9.0 is the latest release. The same issue lists related flaws: unauthenticated event publish on the gateway HTTP port 8081, SSRF through subscription sinks, and missing authorization on streaming RPCs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:vanus affected >= 0.8.0, <= 0.9.0 fixed ?

## How to check

Check whether you run Vanus 0.8.0-0.9.0 (kubectl get pods -A -o jsonpath='{..image}' and look for vanus images). Then test from a host that can reach the gateway gRPC port: grpcurl -plaintext -H 'authorization: Bearer admin' <gateway>:8080 list (port is deployment-specific, check the gateway Service). If the call succeeds you are exposed. Also check which networks can reach the gateway Service and the 8081 CloudEvents port.

## Fix

No patched version exists as of 2026-10-23. Mitigate: do not expose the gateway gRPC (and 8081) ports outside trusted networks, use Kubernetes NetworkPolicy or firewall to allow only known clients, and put TLS/an authenticating proxy in front. Look for a way to replace or disable the default 'admin' user and token, which I could not confirm from the sources. Watch vanus-labs/vanus#647 for a fix.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111998
- 2026-10-23T23:27:43+00:00 analyst — Read VulnCheck advisory and upstream issue vanus-labs/vanus#647 (open, reporter says no fix; latest release v0.9.0, 2023-09). No patched version exists, no public PoC, no exploitation reported; token is the literal string 'admin' in source. Sibling CVE-2026-112000 (missing authz in gateway streaming RPCs) is the same product and issue.

## Documents

- [advisory] VulnCheck advisory: Vanus default admin credentials via gateway https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-default-admin-credentials-via-gateway
- [describes] Vanus #647 [Security] hardcoded token, unauth publish, SSRF, missing authorization (reporter) https://github.com/vanus-labs/vanus/issues/647
- [mentions] Vanus releases (latest v0.9.0, 2023-09) https://github.com/vanus-labs/vanus/releases

## From the sources

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_