CVE-2026-54445

Vantage6: Set admin user and password from environment or configuration

Published Jun 17, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `root`. This is not ideal because attackers know that almost all vantage6 servers have a user with username `root` that probably has admin rights, and the initial password is very weak and it is possible that administrators forget to reset it. Version 5.0.0 fixes the issue. As a workaround, it is possible to delete the `root` user after it has been used to create other users.

Analysis

Technical impact

The vulnerability in Vantage6 allows the creation of an initial administrative account with the username 'root' and the password 'root'. This weak default credential pair is hard‑coded, making it simple for an attacker who can reach the service to authenticate as a privileged user. Once authenticated, the attacker can perform any administrative operation, leading to a full compromise of the system.

Affected Systems

All Vantage6 deployments using versions prior to 5.0.0 are affected. The issue is fixed in release 5.0.0, which removes or changes the default credentials.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1 percent suggests that exploitations are currently rare. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote access to the Vantage6 API or web interface, enabling an attacker to authenticate instantly and gain full administrative control. No special prerequisites are required beyond network reachability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

vantage6

affected

Version	Status	Constraints
`< 5.0.0`	affected	—

No data.

Vendor Product Versions

Vantage6

Version	Status	Scheme	Platform
`[0,5.0.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Vantage6 version 5.0.0 or later to remove the vulnerable default credentials.
Delete the default 'root' account as soon as starting a new installation, or disable the account.
Create new administrative accounts with strong, unique passwords and enforce a password policy.

Generated by OpenCVE AI on June 18, 2026 at 19:53 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-fgmc-2hqj-86v4	Vantage6: Set admin user and password from environment or configuration

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.292% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst#500
https://github.com/vantage6/vantage6/issues/1932
https://github.com/vantage6/vantage6/security/advisories/GHSA-fgmc-2hqj-86v4

History

Jun 18, 2026 9:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Vantage6 Vantage6 vantage6
Vendors & Products		Vantage6 Vantage6 vantage6

Jun 18, 2026 4:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 18, 2026 4:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `root`. This is not ideal because attackers know that almost all vantage6 servers have a user with username `root` that probably has admin rights, and the initial password is very weak and it is possible that administrators forget to reset it. Version 5.0.0 fixes the issue. As a workaround, it is possible to delete the `root` user after it has been used to create other users.
Title		Vantage6: Set admin user and password from environment or configuration
Weaknesses		CWE-1393 CWE-204
References		https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst#500 https://github.com/vantage6/vantage6/issues/1932 https://github.com/vantage6/vantage6/security/advisories/GHSA-fgmc-2hqj-86v4
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}`