CVE-2026-111998: Vanus Event Platform Hardcoded Admin Token Grants Cluster-Wide Takeover

Overview

A critical default-credentials vulnerability has been disclosed in Vanus, the open-source cloud-native event streaming and messaging platform maintained by vanus-labs. Tracked as CVE-2026-111998 with a CVSS v3.1 score of 9.8 (CVSS v4.0: 9.3), the flaw allows an unauthenticated remote attacker to obtain full cluster-admin access simply by presenting a hardcoded Bearer token to the gateway's gRPC proxy port — no credential discovery, brute-forcing, or social engineering required, because the valid credential is baked directly into the shipped software.

Two related but lower-severity issues were disclosed in the same Vanus version range: CVE-2026-111999 (CVSS 7.5, missing authentication allowing unauthenticated event publishing via the gateway's CloudEvents HTTP receiver) and CVE-2026-112000 (CVSS 7.6, missing authorization allowing any authenticated user to call privileged gateway methods without a permission check). Deployments patching for CVE-2026-111998 should confirm all three are addressed.

Technical Details

How It Works

Vanus exposes a gateway component with a gRPC proxy port used to manage the platform — namespaces, eventbuses, users, access tokens, and role bindings, plus reading and publishing events. According to the vendor advisory, the gateway's authentication logic in controller.go / constants.go accepts a fixed, hardcoded Bearer token as valid cluster-admin credentials. Any client that sends this known token to the gRPC proxy port is treated as a fully privileged administrator — there is no per-deployment secret generation, no requirement to change the token on install, and no way to distinguish a legitimate admin session from an attacker who simply read the token out of the public source code or a leaked binary.

This is distinct from a weak-password or default-password problem: the token is a static value shipped in the codebase itself, meaning every unpatched Vanus deployment on the affected versions shares the identical admin credential unless an operator happened to override it through undocumented means.

Impact Assessment

Who Is At Risk

Any organization running Vanus 0.8.0 through 0.9.0 is affected, particularly deployments that:

• Expose the gateway gRPC proxy port beyond a tightly firewalled internal network
• Use Vanus as an event bus or messaging backbone connecting multiple internal services, meaning a cluster compromise cascades into every downstream consumer
• Have not rotated or overridden whatever default token mechanism the gateway ships with

Potential Attack Chains

1. Token Acquisition — Attacker obtains the hardcoded admin Bearer token from the public vanus-labs source code (no reconnaissance against the target needed)
2. Direct Authentication — Attacker sends the token to the exposed gateway gRPC proxy port and is treated as cluster-admin
3. Full Administrative Control — Attacker manages namespaces, eventbuses, users, tokens, and role bindings, and can read or publish events across the cluster
4. Downstream Compromise — Because Vanus mediates events between services, admin-level access can be used to inject malicious events, exfiltrate data in transit, or pivot into every system subscribed to the event bus

Mitigation

Immediate Actions

• Upgrade past 0.9.0 to a release that resolves GitHub issue #647 and removes or properly secures the hardcoded token path
• Firewall the gateway gRPC proxy port so it is reachable only from trusted internal hosts, as an immediate compensating control while patching
• Rotate any tokens, credentials, or secrets that passed through the Vanus event bus during the exposure window, since an attacker with cluster-admin access could have read them in transit

Detection Opportunities

• Review gateway access logs for administrative gRPC calls (namespace/eventbus/user/role management) that do not correlate with a known operator session
• Audit the list of users, tokens, and role bindings on the cluster for entries you did not create
• Look for unexpected eventbus subscriptions or published events that could indicate an attacker probing or exfiltrating data via the bus

Defence-in-Depth

• Never expose internal event-streaming infrastructure directly to the public internet; place it behind a VPN, service mesh, or private network boundary
• Treat any hardcoded or default credential discovered in open-source infrastructure software as a day-one compromise risk and rotate/override it before deployment, not after
• Monitor the vanus-labs/vanus repository and release notes for security advisories given this is the second credential-related disclosure in the project

Discovery & Disclosure

CVE-2026-111998 was reserved and published on October 18, 2026, with the advisory assigned by VulnCheck and documented against the vanus-labs/vanus controller.go and constants.go source files (version 0.9.0), cross-referenced to GitHub issue #647. As of publication, it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploit has been indexed, but because the "exploit" here is simply reading a publicly available source file for the correct token, defenders should assume capability for exploitation already exists.

References

• NVD — CVE-2026-111998
• OffSeq Threat Radar — CVE-2026-111998: Use of Default Credentials in vanus-labs/vanus
• Strix — CVE-2026-111998: Vanus Vulnerability (CVSS 9.8)