Vanus-labs vulnerabilities
We track 3 vulnerabilities in Vanus-labs products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 18, 2026.
Latest Vanus-labs vulnerabilities
- 7.6 High severity
vanus: Missing Authorization
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subs
- 7.5 High severity
vanus: Missing Authentication for Critical Functionality
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns
- 9.8 Critical severity
vanus: Use of Default Credentials
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to man