CVE-2026-111998Critical· 9.8▾ MidnightVanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
vanus >= 0.8.0 <= 0.9.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112000High· 7.6Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs
CVE-2026-111999High· 7.5Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver
CVE-2026-111693Critical· 9.8DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials
CVE-2026-111329Critical· 9.8JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
CVE-2026-108783High· 7.3A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2
CVE-2026-108263Critical· 9.9Astron Agent is an agentic workflow platform for building and running AI agents