CVE-2026-54445

Katalog CVE

CVSS 6.9 · Medium EPSS 0,48%

Kerentanan Observable Response Discrepancy. Skor CVSS 4.0 6.9 (Medium) menurut github.com.

Deskripsi (NVD)

vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `root`. This is not ideal because attackers know that almost all vantage6 servers have a user with username `root` that probably has admin rights, and the initial password is very weak and it is possible that administrators forget to reset it. Version 5.0.0 fixes the issue. As a workaround, it is possible to delete the `root` user after it has been used to create other users.

Rincian

Terbit di NVD

17 Juni 2026

Terakhir diubah

23 Juni 2026

Status NVD

Deferred

CVSS 4.0

6.9 (Medium), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-204: Observable Response Discrepancy
CWE-1393: Use of Default Password

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst#500
• https://github.com/vantage6/vantage6/issues/1932
• https://github.com/vantage6/vantage6/security/advisories/GHSA-fgmc-2hqj-86v4