Vanus CVE-2026-111998

Exploitation requires network reachability to the Vanus gateway gRPC proxy port on an instance running affected versions 0.8.0 through 0.9.0, where a fixed hardcoded admin Bearer token grants cluster-admin. No authentication, user interaction, or non-default configuration is needed - the token is built into the product and is present in the public source tree (internal/primitive/constants.go), so default deployments are vulnerable out of the box. The only real limiting factor is network exposure of the gateway gRPC proxy port: deployments that keep this port private/firewalled or that run versions outside 0.8.0-0.9.0 are not exploitable via this path.

All CVSS signals point to maximum technical severity: the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.3 and describes network-reachable, low-complexity, unauthenticated exploitation yielding full confidentiality, integrity, and availability impact on the Vanus system. The root cause (CWE-1392, Use of Default Credentials) makes exploitation trivial: no EPSS score was supplied, the CVE is NOT in CISA KEV, and no packaged public exploit tool is identified - however, one reference points directly at internal/primitive/constants.go line 37 in the v0.9.0 source tree, meaning the hardcoded admin Bearer token is effectively disclosed in the public GitHub repository, so the practical barrier to weaponization is near zero for anyone who can reach the port. The tension to flag is deployment footprint, not technical risk: Vanus (vanus-labs) is a niche open-source event-streaming platform, so despite the near-maximal CVSS this is more likely an opportunistic/targeted exposure risk than mass exploitation, which is consistent with the absence of EPSS/KEV signals. Note also that the input 'Information Disclosure' tag understates the issue - this is a full administrative takeover (read, publish, and manage users/tokens/role bindings), not merely disclosure.

An attacker locates an internet- or network-exposed Vanus (0.8.0-0.9.0) gateway gRPC proxy port and sends the fixed, hardcoded admin Bearer token - which is readable in the public source (constants.go). Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, the attacker immediately obtains cluster-admin and can read or publish events and create/modify users, tokens, and role bindings. No standalone public exploit tool is identified, but the token's presence in the public repository makes the attack straightforward to reproduce.