VulnSocial

CVE-2026-111998

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-1392

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-18: 110-18
Referenced assets1 URL
By indicator
Full discourse1 post
  • The Hacker Wire@TheHackerWire

    🚨 CVE-2026-111998 (CVSS 9.8 Critical) Hardcoded admin Bearer token in Vanus allows unauthenticated remote attackers to gain full cluster-admin access via the gateway gRPC proxy port. https://www.thehackerwire.com/vulnerability/CVE-2026-111998/ https://t.co/1ZAd9HlVYO

    0100047
    190 followersView on X

Explore more

Back to dashboard