CVE-2026-54445: vantage6 Auth Bypass Vulnerability

CVE-2026-54445 Overview

CVE-2026-54445 affects vantage6, an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 ship with an initial administrative user using the username root and password root. Attackers familiar with vantage6 deployments know this default account exists with administrative privileges on nearly every server. Administrators who forget to rotate the credential leave the platform exposed to trivial unauthenticated takeover. The issue is categorized under [CWE-204] and resolved in version 5.0.0.

Critical Impact
Remote attackers can authenticate as an administrator using well-known default credentials, gaining full control of vantage6 server instances that have not rotated the initial root account.

Affected Products

vantage6 versions prior to 5.0.0
vantage6 server deployments retaining the default root user
vantage6 federated analysis infrastructure with unrotated initial credentials

Discovery Timeline

2026-06-17 - CVE-2026-54445 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54445

Vulnerability Analysis

The vulnerability stems from vantage6 provisioning an initial administrative account with predictable, publicly documented credentials. The username root combined with the password root provides immediate administrative access on any unmaintained instance. Because vantage6 servers are network-reachable, an attacker who locates a deployment can authenticate without exploiting any memory corruption or logic flaw. The weakness sits in initial configuration rather than in code that processes attacker input. Once authenticated, the attacker holds the same privileges as a legitimate administrator, including the ability to manage users, nodes, and analytical tasks across the federated environment.

Root Cause

The root cause is an insecure default configuration. vantage6 bootstrapped new installations with a fixed administrative account whose credentials were identical across every deployment. The platform did not require credential rotation before granting administrative API access. This pattern matches [CWE-204] (Observable Response Discrepancy) as classified by the advisory, where predictable authentication behavior reveals valid credentials to any attacker who tests the documented defaults.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker identifies an exposed vantage6 server, submits an authentication request using root:root, and receives a valid administrative session. Internet-wide scanning makes target identification straightforward. No exploit code is required because the vulnerability is exercised through standard authentication flows.

No verified exploit code is published. The vulnerability is exercised by submitting the documented default credentials to the standard vantage6 login endpoint. Refer to the GitHub Security Advisory GHSA-fgmc-2hqj-86v4 for additional context.

Detection Methods for CVE-2026-54445

Indicators of Compromise

Successful authentication events for the root user originating from unexpected IP ranges or outside administrator workstations.
Creation of new administrative users or API tokens shortly after a root login.
Unexpected task submissions, node registrations, or configuration changes performed by the root account.

Detection Strategies

Audit vantage6 server logs for any authentication attempts using the username root, especially from external networks.
Inventory vantage6 deployments and verify whether the default root account is still present and active.
Correlate vantage6 administrative API calls with known administrator identities to surface unauthorized usage.

Monitoring Recommendations

Forward vantage6 authentication and audit logs to a centralized SIEM for retention and alerting.
Alert on any successful login for the root account and on privilege changes performed by that account.
Monitor outbound connections from vantage6 server hosts for signs of post-compromise activity.

How to Mitigate CVE-2026-54445

Immediate Actions Required

Upgrade vantage6 to version 5.0.0 or later, which removes the insecure default account behavior.
Reset or delete the root user on every existing deployment after provisioning replacement administrators.
Restrict network exposure of vantage6 administrative endpoints to trusted management networks.
Rotate any credentials, API tokens, or secrets that may have been accessible to an unauthorized root session.

Patch Information

The vendor fixed this issue in vantage6 5.0.0. See the GitHub Release Notes 5.0.0 and the tracking GitHub Issue #1932 for implementation details.

Workarounds

Create a new administrative user with a strong, unique password and then delete the root account from the vantage6 server.
If immediate deletion is not possible, change the root password to a long, randomly generated value and enable multi-factor controls at the network layer.
Place vantage6 administrative interfaces behind a VPN or reverse proxy that enforces strong authentication.

bash

# Configuration example: replace the default root account
# 1. Log in once with the default credentials to provision a new admin
# 2. Create a replacement administrator using the v6 CLI
v6 user create --username <new_admin> --role admin
# 3. Verify the new account works, then remove the default root user
v6 user delete --username root