Vanus
Monthly
Missing authorization in the Vanus gateway (versions 0.8.0 through 0.9.0) lets any authenticated user invoke Subscribe, Ack, and unregistered streaming RPCs without per-resource permission checks, enabling cross-tenant subscription hijacking, event read/acknowledgment, consumer starvation, and user enumeration via ListUser. Exploitation requires a valid account and a multi-tenant deployment with a targetable subscription ID; single-tenant or single-user deployments have no cross-tenant victim. No public exploit code or CISA KEV entry was identified at time of analysis, and the practical impact is bounded to event-data exposure, denial of the legitimate consumer, and user enumeration rather than host compromise.
Missing authentication in Vanus 0.8.0 through 0.9.0 allows unauthenticated remote attackers to publish forged CloudEvents into any eventbus through the gateway's CloudEvents HTTP receiver. Attackers can target /namespaces/{ns}/eventbus/{name}/events or the legacy /gateway/{name} path, bypassing token authentication and authPublish checks, so injected events are stored and delivered to subscription sinks. No public exploit code was identified at time of analysis, and the impact is bounded to event-stream integrity rather than data disclosure or denial of service.
Default cluster-admin credentials in Vanus 0.8.0 through 0.9.0 allow unauthenticated remote attackers to take full control of a cluster by presenting a hardcoded Bearer token to the gateway gRPC proxy port. Because the token is embedded in the product source at internal/primitive/constants.go, any deployment exposing that port is exploitable without authentication, user interaction, or non-default configuration, and attackers can manage namespaces, eventbuses, users, tokens, and role bindings and read or publish events. The vendor CVSS 4.0 score is 9.3; no public exploit identified at time of analysis and no CISA KEV entry is provided, though the hardcoded token is publicly visible in the source tree.
Missing authorization in the Vanus gateway (versions 0.8.0 through 0.9.0) lets any authenticated user invoke Subscribe, Ack, and unregistered streaming RPCs without per-resource permission checks, enabling cross-tenant subscription hijacking, event read/acknowledgment, consumer starvation, and user enumeration via ListUser. Exploitation requires a valid account and a multi-tenant deployment with a targetable subscription ID; single-tenant or single-user deployments have no cross-tenant victim. No public exploit code or CISA KEV entry was identified at time of analysis, and the practical impact is bounded to event-data exposure, denial of the legitimate consumer, and user enumeration rather than host compromise.
Missing authentication in Vanus 0.8.0 through 0.9.0 allows unauthenticated remote attackers to publish forged CloudEvents into any eventbus through the gateway's CloudEvents HTTP receiver. Attackers can target /namespaces/{ns}/eventbus/{name}/events or the legacy /gateway/{name} path, bypassing token authentication and authPublish checks, so injected events are stored and delivered to subscription sinks. No public exploit code was identified at time of analysis, and the impact is bounded to event-stream integrity rather than data disclosure or denial of service.
Default cluster-admin credentials in Vanus 0.8.0 through 0.9.0 allow unauthenticated remote attackers to take full control of a cluster by presenting a hardcoded Bearer token to the gateway gRPC proxy port. Because the token is embedded in the product source at internal/primitive/constants.go, any deployment exposing that port is exploitable without authentication, user interaction, or non-default configuration, and attackers can manage namespaces, eventbuses, users, tokens, and role bindings and read or publish events. The vendor CVSS 4.0 score is 9.3; no public exploit identified at time of analysis and no CISA KEV entry is provided, though the hardcoded token is publicly visible in the source tree.