Summary
generated automatically from NVD dataVanus versions 0.8.0 through 0.9.0 ship with a hardcoded default admin token, a default credentials flaw (CWE-1392). An unauthenticated remote attacker can present this fixed Bearer token to the gateway gRPC proxy port and obtain cluster-admin access. That access allows managing namespaces, eventbuses, users, tokens, and role bindings, as well as reading and publishing events. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.8.
NVD description
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 18 oct. 2026
- Updated
- 18 oct. 2026
- Status
- Received
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (4)
Similar CVEs
Other vulnerabilities of type CWE-1392
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.