CVE-2026-54445: Vantage6 Weak Default Credentials Vulnerability
Summary
CVE-2026-54445: Vantage6: Set admin user and password from environment or configuration. Affects vantage6 versions < 5.0.0. Fixed in 5.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vantage6 is an open-source platform designed for secure and efficient data sharing and collaboration among organizations. It allows users to run distributed computations on sensitive data without exposing the data itself. However, the platform has a significant security flaw related to its initial user setup, which defaults to a weak username and password combination, making it susceptible to unauthorized access.
Vulnerability Detail
The vulnerability arises from Vantage6's practice of creating an initial user with the username 'root' and a default password of 'root'. This setup is problematic as it is widely known and predictable, allowing attackers to easily gain administrative access. The weak password can also be overlooked by administrators, leading to potential exploitation. The vulnerability is classified with a CVSS score of 6.9, indicating a moderate risk level.
How To Fix
Latest published version: 5.0.3 as of 22 Oct 2026
pip install --upgrade "vantage6==5.0.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.0
This is the first release that contains the fix.
pip install --upgrade "vantage6==5.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can delete the 'root' user after creating other users to mitigate the risk associated with the default credentials. Additionally, it is advisable to implement a strong password policy for any new users created.
Conclusion
The CVE-2026-54445 vulnerability in Vantage6 highlights the risks associated with weak default credentials. Users are strongly encouraged to upgrade to version 5.0.0 or later to enhance security. Implementing workarounds and strong password policies can also help mitigate the risks until an upgrade is possible.
See every vulnerability recorded for vantage6 →
FAQ
The vulnerability involves the use of weak default credentials for the initial admin user, which can be easily exploited by attackers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If upgrading is not possible, ensure to delete the 'root' user after creating other users and implement strong password policies.
If exploited, attackers can gain administrative access to the Vantage6 server, potentially leading to data breaches and unauthorized actions.
Yes, you can delete the 'root' user after creating other users and ensure that strong passwords are enforced for all accounts.
References
Related vulnerabilities
Recent vulnerabilities recorded for vantage6.
