CVE-2026-112000 is a high-severity vulnerability in Vanus versions 0.8.0 through 0.9.0. The vulnerability allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks, potentially leading to unauthorized access and event manipulation. This could result in the hijacking of subscription IDs, unauthorized reading and acknowledgement of events, and starvation of leg [truncated]
CVE-2026-111999 is a high-severity vulnerability in Vanus versions 0.8.0 through 0.9.0, allowing unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. The vulnerability exists due to missing authentication, enabling attackers to bypass token authentication and authPublish checks. This CVE was published on 2026-10-18T12:17:11.870Z and has not been [truncated]
CVE-2026-111998 is a critical vulnerability in Vanus versions 0.8.0 through 0.9.0, featuring hardcoded admin credentials. Attackers can exploit this vulnerability to gain cluster-admin access and manage sensitive resources, including namespaces, eventbuses, users, tokens, and role bindings, and read or publish events. This vulnerability requires immediate attention to prevent potential exploitation. Affec [truncated]
