Vanus 0.8.0 through 0.9.0 contain a hardcoded admin token that allows unauthenticated remote attackers to obtain cluster‑admin privileges by sending the fixed Bearer token to the gateway gRPC proxy port. The attacker can then manage namespaces, eventbuses, users, tokens, role bindings and read or publish events, effectively giving full control over the cluster. This flaw is a classic example of default credentials that bypass all authentication and authorization mechanisms, exposing the system to total compromise.

The affected product is Vanus by vanus‑labs, versions 0.8.0 through 0.9.0. No specific sub‑product or operating system versions are listed, but the vulnerability resides in the gateway gRPC proxy component of the cluster‑management software.

The CVSS score of 9.3 denotes exploitability and impact as critical. EPSS is not available, so the current probability of exploitation is unknown, yet the lack of authentication makes this a high‑value target for attackers that can reach the gRPC port. The vulnerability is not listed in the CISA KEV catalog, but its severity and broad access make it a priority for immediate action. Remote attackers need only network connectivity to the gateway port; no privileged credentials are required to exploit the issue.