Key points
- CVE-2026-111998 affects Vanus versions 0.8.0 through 0.9.0.
- Attackers use a hardcoded Bearer token to access the gateway gRPC proxy.
- The flaw grants cluster-admin privileges for managing namespaces and users.
Unauthenticated remote attackers can seize full administrative control of Vanus clusters running versions 0.8.0 through 0.9.0. This capability stems from a hardcoded admin token that bypasses authentication checks entirely.
According to the NVD record for CVE-2026-111998, an attacker sends this fixed Bearer token to the gateway gRPC proxy port. This action grants cluster-admin access without requiring prior credentials or valid user sessions.
Scope of Access
The compromised token allows management of namespaces, eventbuses, users, tokens and role bindings. Attackers can also read or publish events within the affected system. This level of access effectively surrenders total control of the messaging infrastructure.
Affected Versions
The vulnerability is present in Vanus releases from 0.8.0 up to and including 0.9.0. The vendor, vanus-labs, developed these versions. Systems running any release within this range are exposed to this specific credential bypass.
What happens next
Security teams should assess their exposure immediately. Monitor network traffic for unauthorised use of the default token. Once the vendor provides an update, apply it without delay.
Why this attack works
Default credentials represent a persistent risk in software deployment. When administrative tokens are hardcoded, they remain static across all installations. Attackers exploit this predictability to bypass authentication stages. Teams usually check for such static secrets during initial hardening. Verifying that default tokens are changed or removed is essential for securing new deployments against this class of intrusion.
What to do and how to stay safe: Vanus
- Audit deployed Vanus instances to confirm they are not running versions 0.8.0 to 0.9.0.
- Monitor gateway gRPC proxy logs for repeated authentication attempts using the known token.
- Restrict network access to the gRPC proxy port to trusted internal IPs only.
- Review role bindings and user lists for unauthorised changes or new accounts.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Vanus versions are vulnerable to CVE-2026-111998?
Versions 0.8.0 through 0.9.0 are affected by this default credentials vulnerability.
What does the hardcoded token allow attackers to do?
It grants cluster-admin access to manage namespaces, users, tokens and publish events.
Is there a confirmed fix for this issue?
The source material does not state whether a fix exists.
