Understanding and Defending Against CVE-2026-111998: Default Credentials Vulnerability in Vanus
CVE-2026-111998 is a critical vulnerability in Vanus versions 0.8.0 through 0.9.0 that allows unauthenticated remote attackers to gain cluster-admin access using a hardcoded admin token. This vulnerability has a CVSS score of 9.8 and can lead to full control over the Vanus cluster, enabling attackers to manage namespaces, eventbuses, users, tokens, and role bindings, as well as read or publish events. Understanding this vulnerability is crucial for defenders to protect their Vanus deployments.