CVE-2026-111998: Use of Default Credentials in vanus-labs vanus

CVE-2026-111998 describes a default credentials vulnerability in vanus-labs vanus versions 0.8.0 through 0.9.0. The product contains a hardcoded admin token that can be used without authentication to access the gateway gRPC proxy port. Attackers leveraging this token can perform cluster-admin level operations including managing namespaces, eventbuses, users, tokens, role bindings, and manipulating event data. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can gain full cluster-admin access, allowing complete control over the vanus cluster's management and event data. This includes the ability to manage critical resources and read or publish events, potentially leading to full compromise of the system's integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the gateway gRPC proxy port and monitor for unauthorized use of the hardcoded Bearer token. Consider implementing additional access controls or network segmentation to limit exposure.