Read the docs

vanus-labs

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

vanus-labs records in CISA KEV

No vanus-labs vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-76150 CVE-2026-111998 · GHSA-7rhh-2jm2-9fgj

Default admin credentials in Vanus gateway allow cluster takeover

Priority HIGH 81

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00688 Published 2026-10-18 No fix listed CWE-1392
TI-2026-76151 CVE-2026-111999 · GHSA-v6f2-wm97-3p2m

Vanus CloudEvents gateway receiver missing authentication

Priority MEDIUM 44

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00532 Published 2026-10-18 No fix listed CWE-306
TI-2026-76152 CVE-2026-112000 · GHSA-93jv-pwc6-2cqf

Missing authorization in Vanus gateway enables subscription hijacking

Priority LOW 31

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00289 Published 2026-10-18 No fix listed CWE-862
Open these records in search →