CVE-2026-111998 is a critical (CVSS 9.8) default-credentials flaw in Vanus 0.8.0 through 0.9.0. It lets an unauthenticated remote attacker take cluster-admin control by sending a hardcoded Bearer token.
What Is It
Vanus 0.8.0 through 0.9.0 ships with a hardcoded admin token. If an attacker sends that fixed Bearer token to the gateway gRPC proxy port, they get cluster-admin access without any other authentication. The weakness is classified as CWE-1392 (Use of Default Credentials). VulnCheck disclosed the issue, and NVD published it on 2026-10-18. Its NVD status is currently "Received."
The VulnCheck references point to two files in the v0.9.0 source tree: internal/primitive/constants.go, where the token is defined, and internal/controller/tenant/controller.go, which holds the related logic.
Why It Matters
Cluster-admin access gives an attacker full control of a Vanus deployment. According to the record, an attacker can:
- Manage namespaces and eventbuses
- Manage users, tokens, and role bindings
- Read events
- Publish events
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack works over the network and is low complexity. It needs no privileges and no user interaction, and its impact on confidentiality, integrity, and availability is high. VulnCheck's CVSS 4.0 score is 9.3 (Critical). Every install uses the same fixed token, so any reachable gateway gRPC proxy port on an affected version is exposed.
KEV status: The CISA KEV entry supplied for this CVE is empty. KEV does not confirm active exploitation at this time.
What's Vulnerable
- Vendor: vanus-labs
- Product: Vanus (
pkg:golang/github.com/vanus-labs/vanus) - Affected versions: 0.8.0 through 0.9.0 inclusive (semver)
- Exposed component: the gateway gRPC proxy port
By default, the record lists all other versions as unaffected. NVD has no CPE entries for this CVE yet.
Patch Status
The supplied NVD record does not name a fixed version or a vendor patch. There is no CISA KEV entry, so no federal remediation deadline or required action applies. The record lists a GitHub issue (vanus-labs/vanus #647) as a reference. Operators running Vanus 0.8.0–0.9.0 should check the vendor repository and the VulnCheck advisory for remediation guidance.