Key points
- Vanus versions 0.8.0 through 0.9.0 contain a critical default credential vulnerability rated CVSS 9.3.
- Attackers use a hardcoded Bearer token to gain cluster-admin access via the gateway gRPC proxy port.
- No patch has been confirmed yet for the affected versions of the Vanus platform.
Security teams managing Vanus infrastructure must address a critical flaw in versions 0.8.0 through 0.9.0. The issue involves hardcoded default credentials that allow unauthenticated remote attackers to gain cluster-admin access. According to the National Vulnerability Database record for CVE-2026-111998, the vulnerability receives a CVSS score of 9.3. This high severity rating reflects the ease with which an attacker can compromise the system without any prior authentication or valid user credentials.
In plain English
The Vanus application includes a fixed admin token that is not unique to each installation. An attacker can send this known token to the gateway's gRPC proxy port. Once accepted, the system grants the attacker full administrative privileges. This allows the intruder to manage namespaces, eventbuses, users, tokens, and role bindings. They can also read or publish events within the cluster. The flaw is classified under CWE-1392, which covers the use of hard-coded credentials.
The background
The affected software is produced by vanus-labs. The vulnerability exists in all releases up to and including version 0.9.0. There is no mention of a fix or update available for these versions in the current advisory data. This incident follows a pattern of critical authentication failures seen in other platforms, such as the Wukong_HRM bypass reported by Vuln Post on October 11, 2026. That earlier flaw also allowed credential-free access to administrative controls.
What changes now
Organizations running Vanus 0.8.0 through 0.9.0 face immediate risk of full cluster compromise. Since no vendor patch is confirmed, exposure remains high. Teams must verify if their instances are reachable from untrusted networks. The hardcoded token acts as a universal key for administrative functions. Without a software update, the only mitigation is network isolation or blocking access to the gRPC proxy port. Monitoring for unauthorized token usage is essential until a remediation path is clear.
Who needs to act first
Teams should prioritize systems exposed to the internet or untrusted networks. Check whether the gRPC proxy port is accessible from external zones. Isolate affected instances behind strict firewall rules while awaiting a vendor update. Back up configuration data before making any network changes. Verify that monitoring tools can detect the specific hardcoded token in traffic logs. Do not disable authentication mechanisms, as this increases risk.
What to do and how to stay safe: Vanus
- Audit network access controls to ensure the gRPC proxy port is not exposed to public internet ranges.
- Monitor server logs for connections using the known hardcoded Bearer token to detect active exploitation.
- Verify that all Vanus instances are running versions outside the 0.8.0 to 0.9.0 range, if possible.
- Prepare an incident response plan that includes isolating compromised clusters to prevent lateral movement.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Vanus are affected by CVE-2026-111998?
Versions 0.8.0 through 0.9.0 of Vanus are affected by this default credential vulnerability.
Is there a patch available for this vulnerability?
No fix has been confirmed yet for the affected versions of Vanus.
What can an attacker do with this vulnerability?
Attackers can gain cluster-admin access to manage namespaces, users, tokens, and publish events.
