Organisations at Risk: Vanus 0.8.0-0.9.0 Critical Flaw Grants Full Admin Control via Fixed Token

The Vanus event streaming system contains a severe authentication bypass in versions 0.8.0 through 0.9.0. According to the National Vulnerability Database record for CVE-2026-111998, the software ships with a hardcoded administrative token. This static credential allows any remote attacker to authenticate as a cluster administrator without providing valid user credentials or interacting with standard identity providers.

How does the hardcoded token enable full cluster control?

The vulnerability is associated with weakness CWE-1392. In this implementation, the gateway gRPC proxy port accepts a fixed Bearer token for authentication. An attacker does not need to exploit complex logic flaws or brute-force passwords. They simply send the known token in the request header. This action grants immediate cluster-admin privileges, bypassing all intended access controls defined in the cluster configuration.

What capabilities does an attacker gain after authentication?

Once authenticated using the hardcoded token, the attacker gains comprehensive control over the Vanus cluster infrastructure. The National Vulnerability Database description states that the attacker can manage namespaces, eventbuses, users, tokens, and role bindings. Furthermore, the attacker can read existing events and publish new ones. This level of access allows for complete data exfiltration, service disruption, and the creation of persistent backdoors through new user accounts and role assignments.

Which versions of Vanus are affected by this flaw?

The vulnerability affects Vanus versions 0.8.0 through 0.9.0. The National Vulnerability Database lists "vanus-labs vanus up to 0.9.0" as the affected component. Organizations running any release within this version range are exposed to unauthenticated remote attacks. There is no indication in the source material that earlier versions contain this specific hardcoded token, but the risk is confirmed for the stated range.

What is the immediate risk to organizations using Vanus?

The immediate risk is total compromise of the event streaming infrastructure. Because the token is hardcoded and known, any instance of Vanus 0.8.0 to 0.9.0 exposed to the internet or an untrusted network is vulnerable. Attackers can automate the discovery and exploitation of these instances. The critical CVSS score of 9.3 reflects the ease of exploitation and the high impact of gaining cluster-admin access.

What analysts watch for

Teams usually monitor network traffic for unexpected gRPC connections to Vanus gateway ports. Analysts check for authentication attempts using static or repeated Bearer tokens, which indicate exploitation of hardcoded credentials. They examine cluster logs for sudden changes in role bindings, new user creation, or unauthorized event publishing. Persistence checks involve reviewing namespace configurations and eventbus definitions for anomalies. Incident responders look for lateral movement from compromised clusters to other internal services that trust Vanus event data.

Background: National Vulnerability Database

The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.

Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes

What to do and how to stay safe: Vanus

• Isolate Vanus clusters running versions 0.8.0 through 0.9.0 from untrusted networks until an update is available.
• Monitor gateway gRPC proxy logs for authentication attempts using the known hardcoded Bearer token.
• Audit cluster logs for unauthorized changes to namespaces, users, tokens, and role bindings.
• Plan to upgrade to a patched version once the vendor provides an update that removes the hardcoded token.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for the Vanus hardcoded token vulnerability?

The vulnerability is assigned CVE-2026-111998 by the National Vulnerability Database.

Which versions of Vanus are vulnerable to this attack?

Vanus versions 0.8.0 through 0.9.0 are affected by this critical default credentials vulnerability.

What can an attacker do with the hardcoded admin token?

Attackers can gain cluster-admin access to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.