Unauthenticated Cluster-Admin Access in Vanus via Hardcoded Credentials

Vanus versions 0.8.0 through 0.9.0 are affected by a critical default credentials vulnerability (CVE-2026-111998). The software ships with a hardcoded administrative Bearer token that is accessible to unauthenticated remote attackers. By supplying this fixed token via the gateway gRPC proxy port, an attacker can authenticate as a cluster administrator. This level of access grants the ability to perform sensitive administrative operations, including the management of namespaces, eventbuses, user accounts, and role bindings. Furthermore, attackers can intercept, read, or publish events within the system, leading to full compromise of the event processing infrastructure. This vulnerability is of high importance to organizations deploying Vanus in production environments, as it allows for trivial remote takeover of the management plane.

Impact

Successful exploitation grants an unauthenticated attacker full cluster-admin privileges within the Vanus environment. This allows for total control over the event-streaming architecture, including data exfiltration via unauthorized event subscription and the ability to manipulate data flows or system configurations. There are currently no reports of widespread victim impact, but the trivial nature of the exploit poses a high risk to all organizations running affected versions of Vanus.

Recommendation

• Upgrade all Vanus deployments to a version beyond 0.9.0 that removes the hardcoded credential.
• If immediate patching is not possible, restrict access to the Vanus gateway gRPC proxy port to authorized internal IP addresses only using network access control lists (ACLs).
• Review access logs for the gRPC proxy service for connections using non-standard or suspected default administrative Bearer tokens.