vantage6
CVE-2026-54445
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible login with publicly known default credentials; attacker needs no prior privileges, but impact is limited to low confidentiality, integrity, and availability per the CVSS 4.0 baseline.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2Blast Radius
ecosystem impact- 3 pypi packages depend on vantage6 (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 5.0.0.
DescriptionCVE.org
vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username root and password root. This is not ideal because attackers know that almost all vantage6 servers have a user with username root that probably has admin rights, and the initial password is very weak and it is possible that administrators forget to reset it. Version 5.0.0 fixes the issue. As a workaround, it is possible to delete the root user after it has been used to create other users.
AnalysisAI
Default hardcoded admin credentials in vantage6 expose servers running versions prior to 5.0.0 to unauthorized administrative access by any network-accessible attacker who attempts the well-known username 'root' and password 'root'. The vantage6 server initializes with this superuser account on first deployment, and administrators who fail to change or delete it leave a predictable, trivially exploitable entry point. While not confirmed actively exploited (no CISA KEV listing), the predictability of the credential pair and the sensitivity of vantage6's federated privacy-preserving analytics data make this a meaningful operational risk for unpatched deployments.
Technical ContextAI
vantage6 is a Python-based open-source infrastructure platform (pip package cpe:2.3:a:vantage6:vantage6:*:*:*:*:*:*:*:*) designed for federated, privacy-preserving data analysis across distributed organizations. The server component (vantage6-server) bootstraps a superuser account using hardcoded constants stored in SUPER_USER_INFO at startup, assigning the 'Root' role with administrative privileges. The listed CWE is CWE-204 (Observable Response Discrepancy), which is inconsistent with the actual root cause - the vulnerability is more precisely characterized as CWE-1392 (Use of Default Credentials) or CWE-798 (Use of Hard-coded Credentials). The GHSA advisory and community patch show the fix involves reading the initial root password from an environment variable (V6_INITIAL_ROOT_PASSWORD_FILE) or Docker secret rather than relying on a hardcoded default, following the MongoDB initialization pattern.
RemediationAI
The primary fix is to upgrade to vantage6 5.0.0 or later, which resolves the issue by requiring the initial root password to be supplied via environment variable or configuration rather than using a hardcoded default. Upgrade guidance and release notes are at https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst#500. For deployments that cannot immediately upgrade, the official workaround is to delete the 'root' user account after it has been used to create at least one other administrative user; this eliminates the known-credential attack surface entirely and carries no functional downside once alternate admin accounts exist. A community patch published in the advisory (GHSA-fgmc-2hqj-86v4) demonstrates reading the initial password from a Docker secret via the V6_INITIAL_ROOT_PASSWORD_FILE environment variable, which is suitable for containerized deployments. Operators should also audit server logs for any unexpected logins using the root username as an indicator of prior compromise.
vantage6 is privacy preserving federated learning infrastructure. Rated high severity (CVSS 7.2), this vulnerability is
Critical authentication bypass vulnerability in vantage6 (an open-source federated learning and privacy-enhancing techno
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul
vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Rated high severity (CVS
vantage6 servers auto-generate JWT secret keys using UUID1, a predictable algorithm that lacks cryptographic strength, a
Broken authorization in vantage6's algorithm store allows any authenticated algorithm developer to overwrite a peer's pe
Improper access control in vantage6 nodes prior to version 5.0.0 allows malicious algorithm containers to read input and
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Le
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Rated medium severity (C
vantage6 is privacy preserving federated learning infrastructure. Rated medium severity (CVSS 5.4), this vulnerability i
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today