CVE-2026-54445 Vantage6: Set admin user and password from environment or configuration
vantage6 servers include a default root account with weak credentials, allowing attackers to gain administrative access if not manually removed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54445?
CVE-2026-54445 is a medium-severity vulnerability in vantage6, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `root`. This is not ideal because attackers know that almost all vantage6 servers have a user with username `root` that probably has admin rights, and the initial password is very weak and it is possible that administrators forget to reset it. Version 5.0.0 fixes the issue. As a workaround, it is possible to delete the `root` user after it has been used to create other users.
Which versions are affected by CVE-2026-54445?
3 open source packages ship an affected version, including vantage6.
| Package | Affected | Fixed in |
|---|---|---|
vantage6 PyPI | All versions | 5.0.0 |
vantage6 PyPI | All versions | 5.0.0 |
vantage6 PyPI | All versions | 5.0.0 |
How do I fix CVE-2026-54445?
Upgrade vantage6 to 5.0.0 or later.
Is CVE-2026-54445 being exploited?
There is no known exploitation of CVE-2026-54445 in the wild and no public exploit code.
Sources
Also known as GHSA-fgmc-2hqj-86v4, PYSEC-2026-3400.