{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3avanusvanus0.9.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vanus:vanus:0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:vanus:vanus:0.9.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111998"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Vanus (0.8.0-0.9.0)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","authentication-bypass","cloud-infrastructure"],"_cs_type":"advisory","_cs_vendors":["Vanus"],"content_html":"\u003cp\u003eVanus versions 0.8.0 through 0.9.0 are affected by a critical default credentials vulnerability (CVE-2026-111998). The software ships with a hardcoded administrative Bearer token that is accessible to unauthenticated remote attackers. By supplying this fixed token via the gateway gRPC proxy port, an attacker can authenticate as a cluster administrator. This level of access grants the ability to perform sensitive administrative operations, including the management of namespaces, eventbuses, user accounts, and role bindings. Furthermore, attackers can intercept, read, or publish events within the system, leading to full compromise of the event processing infrastructure. This vulnerability is of high importance to organizations deploying Vanus in production environments, as it allows for trivial remote takeover of the management plane.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an unauthenticated attacker full cluster-admin privileges within the Vanus environment. This allows for total control over the event-streaming architecture, including data exfiltration via unauthorized event subscription and the ability to manipulate data flows or system configurations. There are currently no reports of widespread victim impact, but the trivial nature of the exploit poses a high risk to all organizations running affected versions of Vanus.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all Vanus deployments to a version beyond 0.9.0 that removes the hardcoded credential.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, restrict access to the Vanus gateway gRPC proxy port to authorized internal IP addresses only using network access control lists (ACLs).\u003c/li\u003e\n\u003cli\u003eReview access logs for the gRPC proxy service for connections using non-standard or suspected default administrative Bearer tokens.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-18T12:20:55Z","date_published":"2026-10-18T12:20:55Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vanus-default-creds/","summary":"Vanus versions 0.8.0 through 0.9.0 contain a critical vulnerability allowing unauthenticated remote attackers to gain cluster-admin privileges using a hardcoded default administrative token.","title":"Unauthenticated Cluster-Admin Access in Vanus via Hardcoded Credentials","url":"https://feed.craftedsignal.io/briefs/2026-10-vanus-default-creds/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:vanus:vanus:0.9.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}