CVE-2026-111998 is a default credentials flaw (CWE-1392) in Vanus 0.8.0 through 0.9.0, scored 9.8 critical. A fixed bearer token grants cluster-admin on the gateway gRPC port. Remove or replace the default token, restrict the gateway to trusted networks, and check the project for a fixed release.
What's affected
Vanus 0.8.0 through 0.9.0, per the CVE record. The record says the hard-coded admin token works against the gateway gRPC proxy port and gives control over namespaces, event buses, users, tokens and role bindings, and lets the caller read or publish events.
The researcher issue on the project's tracker lists three further problems found in the same review: unauthenticated event publishing on the gateway, server side request forgery through a subscription sink, and missing authorization with allow by default behavior. Those are separate from this CVE, so check which of them apply to you.
I could not confirm a fixed release.
How to check if you're exposed
Check the version of your Vanus deployment from your deployment manifests or image tags. If it is within 0.8.0 to 0.9.0, treat it as affected.
Then check exposure. List where the gateway port is reachable from, in particular any load balancer or node port that faces beyond the trusted cluster network. Inspect the user list and tokens in the controller for the default user and for unrecognized ones.
Review event streams and namespaces for objects you did not create.
You can also run the free in-browser dependency scan or browse the Gold directory to see where a package or product shows up in your stack.
What to do now
- Restrict the gateway and controller ports to trusted networks with network policies or firewall rules.
- Replace or remove the default administrator user and its token, and create named users with the least rights they need.
- Rotate every token and review role bindings for unexpected entries.
- Review namespaces, event buses and subscriptions for objects you did not create, especially subscription sinks that point to internal addresses.
- Check the project for a fixed release and read the researcher issue for the related findings.
Why it matters
The deployment creates an administrator whose token is a short, fixed word that is the same on every install. The class is CWE-1392, use of default credentials. With that token a caller gets the top role, so there is no step from a foothold to full control.
Event platforms sit in the middle of many systems. The ability to read or publish events can leak data and also trigger actions in downstream services. Treat the event bus as part of your trust boundary.
The record does not flag this CVE as exploited in the wild and it is not a CISA Known Exploited Vulnerability.
Quick check
Are the other findings in the issue the same CVE?
No. The researcher lists several problems, and this CVE covers the default cluster-admin token. Check each separately.
Is a fix available?
I could not confirm one. Check the project repository.
Sources
Last reviewed: 19 October 2026.
