Default Credentials in Vanus Allow Unauthenticated Admin Access

Executive Summary

This vulnerability in Vanus versions 0.8.0 through 0.9.0 involves hardcoded default admin credentials. Attackers can exploit it by sending a fixed Bearer token to the gateway gRPC proxy port to gain unauthenticated cluster-admin access. This allows full control over system components like namespaces, eventbuses, users, tokens, and role bindings, as well as the ability to read or publish events.

Useful 0 Not Useful 0

Detection Guidance

Check if Vanus versions 0.8.0 through 0.9.0 are installed by running commands like 'vanus version' or inspecting package managers. Scan network traffic for unauthenticated gRPC requests to the gateway proxy port (default 8081) with the hardcoded Bearer token 'admin'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to take over Vanus deployments as cluster-admin without authentication. They can create, modify, or delete resources, forge events, and access sensitive data. The impact includes full system compromise, data theft, unauthorized event publishing, and potential lateral movement within internal networks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It enables unauthorized access to sensitive data, which could lead to breaches of GDPR's confidentiality and integrity principles or HIPAA's safeguards for protected health information. Organizations using affected versions may face regulatory penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to a patched version of Vanus if available. If not, restrict network access to the gRPC gateway port (8081) using firewalls. Remove or rotate the hardcoded admin token and enforce strong authentication for all API endpoints.

Useful 0 Not Useful 0