Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: vanus-labs Clear all filters
TI-2026-76152 CVE-2026-112000 · GHSA-93jv-pwc6-2cqf

Missing authorization in Vanus gateway enables subscription hijacking

Priority LOW 31

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00289 Published 2026-10-18 No fix listed CWE-862
TI-2026-76151 CVE-2026-111999 · GHSA-v6f2-wm97-3p2m

Vanus CloudEvents gateway receiver missing authentication

Priority MEDIUM 44

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00532 Published 2026-10-18 No fix listed CWE-306
TI-2026-76150 CVE-2026-111998 · GHSA-7rhh-2jm2-9fgj

Default admin credentials in Vanus gateway allow cluster takeover

Priority HIGH 81

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00688 Published 2026-10-18 No fix listed CWE-1392