External risk intelligence

Vanus Default Admin Credentials Allow Cluster Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-111998

The vulnerability resides in the gateway gRPC proxy component of the Vanus platform. As a gateway service responsible for managing namespaces and event traffic, it is commonly deployed as an edge service or API endpoint to facilitate communication, making it frequently reachable from the network periphery in typical cloud-native or distributed deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in Vanus software allows unauthenticated remote attackers to gain full administrative access to the cluster by exploiting hardcoded, default credentials. This could enable unauthorized management of critical resources and access to event data within the affected system.

Default credentials grant full cluster control.
Leadership should track exposure and relevance.
Confirm if this technology is in use.

Attack Path

How an attacker could exploit the issue

An attacker can reach the Vanus platform over the network and interact with its gateway gRPC proxy port. By leveraging a hardcoded administrator token, an unauthenticated attacker can bypass authentication and gain full cluster-administrative privileges, allowing them to manage various aspects of the system and access event data.

Accessible over the network.
Uses default, hardcoded credentials.
Full cluster-admin access.

Live Threat

Current exploitation, exposure, and threat context

Vanus versions 0.8.0 through 0.9.0 are susceptible to a critical vulnerability. An unauthenticated remote attacker could exploit this by using a hardcoded admin token to gain cluster-admin access. This allows them to manage namespaces, eventbuses, users, tokens, role bindings, and read or publish events.

Cluster namespaces and event data could be affected.
Attackers can send a fixed token to the gateway.
Unrestricted access to cluster management functions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Vanus platform's gateway component, which manages critical cluster functions, is vulnerable to unauthenticated remote attackers using hardcoded administrative credentials. This necessitates rapid identification of all Vanus deployments, confirmation of their exposure and criticality, and immediate engagement with the platform or application owners. The first practical step is to locate all instances of Vanus, verify their network reachability and business impact, identify the responsible owner, and then prioritize remediation based on the assessed risk.

Platform or application owners should lead.
Verify Vanus instances and network exposure.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Vanus and what is it used for?

Vanus is a serverless cloud-native event streaming platform. It is designed to help developers build event-driven applications by managing the ingestion, processing, and routing of event data across distributed systems. It acts as an infrastructure layer that bridges various services, allowing users to move and transform data between different cloud environments, databases, and message queues efficiently.

What does CVE-2026-111998 mean for system security?

This vulnerability is classified as Use of Default Credentials (CWE-1392). In simple terms, the software includes a hardcoded administrator token that remains the same for every installation. Because this token is embedded directly into the code, it acts like a universal key. If an attacker knows this secret, they can present it to the system to bypass all authentication checks and immediately gain full cluster-admin privileges.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending the known, fixed Bearer token to the system's gateway gRPC proxy port. The vulnerability is specifically tied to the authentication mechanism of this proxy. It is important to note that actions not involving the gateway or attempts to use different, random credentials will not trigger the flaw, as the system specifically looks for the hardcoded token to grant elevated access.

Is my deployment relevant to this threat?

If you are running Vanus versions 0.8.0 through 0.9.0, your system is affected. Halo Surface Signal identifies this as a significant concern because the vulnerable gRPC proxy is designed to manage critical functions like namespaces and event traffic. Because this component is often deployed as an edge service or public API endpoint to facilitate communication, it is frequently reachable from the network periphery, increasing the risk of unauthorized access.

What should I do if I am running this software?

The immediate priority is to identify all instances of Vanus within your environment. Once identified, confirm the network reachability of the gateway component to understand how visible these services are. After verifying your footprint, engage with your application or platform owners to coordinate a response plan. Focus on isolating these instances from untrusted network segments while you work toward the recommended security updates or configuration changes provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.