3 CVEs publicados el 2026-10-18 · CVSS máximo 9.8/10.
Producto afectado
Vanus 0.8.0 – 0.9.0
CVEs de este lote
| CVE | Severidad | CVSS | EPSS | Estado | Descripción |
|---|---|---|---|---|---|
| CVE-2026-111998 | CRITICAL | 9.8 | — | Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. | |
| CVE-2026-112000 | HIGH | 7.6 | — | Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. | |
| CVE-2026-111999 | HIGH | 7.5 | — | Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. |