Threat Intelligence Database

Vanus versions 0.8.0 through 0.9.0 have a missing authorization vulnerability in the gateway component. This flaw allows any authenticated user to invoke Subscribe, Ack, and unregistered methods without proper permission checks. Exploitation enables attackers to hijack other tenants' subscriptions, read and acknowledge their events, disrupt legitimate consumers, and enumerate cluster users.

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.

Vanus versions 0.8.0 through 0.9.0 have a critical vulnerability due to the use of hardcoded default credentials. This flaw allows unauthenticated remote attackers to gain cluster-admin privileges by sending a fixed Bearer token to the gateway gRPC proxy port. Exploitation enables management of namespaces, eventbuses, users, tokens, role bindings, and the ability to read or publish events.