CVE-2026-111998
Last modified
CVE-2026-111998 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events..
Description
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| vanus-labs | vanus | >= 0.8.0, <= 0.9.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-111998?
How severe is CVE-2026-111998?
How do I fix CVE-2026-111998?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11197Insufficient policy enforcement in Workers in Google Chrome …6.5
- CVE-2026-11198Insufficient validation of untrusted input in Codecs in Goog…9.6
- CVE-2026-111984A vulnerability has been found in AUTOMATIC1111 stable-diffu…4.3
- CVE-2026-111985A vulnerability was found in AUTOMATIC1111 stable-diffusion-…4.3
- CVE-2026-11199Inappropriate implementation in WebRTC in Google Chrome prio…5.9
- CVE-2026-111997ip-address before 10.7.4 allows a denial of service (CPU con…6.3
- CVE-2026-111999Vanus 0.8.0 through 0.9.0 contains a missing authentication …7.5
- CVE-2026-1120A vulnerability has been found in Yonyou KSOA 9.0. The impac…9.8
- CVE-2026-11200Inappropriate implementation in WebRTC in Google Chrome prio…6.5
- CVE-2026-112000Vanus 0.8.0 through 0.9.0 contains a missing authorization v…7.6
- CVE-2026-112001ProjectSend 2.0.0 before 2.7.0 contains an incorrect authori…7.2
- CVE-2026-112002ProjectSend 2.5.0 before 2.7.0 contains an unverified passwo…6.8
Are you affected by CVE-2026-111998?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST