{"answers":{"affected":"3 open source packages ship an affected version, including vantage6.","exploited":"There is no known exploitation of CVE-2026-54445 in the wild and no public exploit code.","fix":"Upgrade vantage6 to 5.0.0 or later.","what":"CVE-2026-54445 is a medium-severity vulnerability in vantage6, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-54445 and fix it if it is affected.\n\nWhat it is: CVE-2026-54445 is a medium-severity vulnerability in vantage6, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-54445 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- vantage6 (PyPI): affected all versions; fixed in 5.0.0\n- vantage6 (PyPI): affected all versions; fixed in 5.0.0\n- vantage6 (PyPI): affected all versions; fixed in 5.0.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-54445/ (Markdown: https://insights.sbomify.com/CVE-2026-54445/index.md)","id":"CVE-2026-54445","markdown":"https://insights.sbomify.com/CVE-2026-54445/index.md","name":"CVE-2026-54445","record":{"aliases":["GHSA-fgmc-2hqj-86v4","PYSEC-2026-3400"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["account_takeover","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"vantage6 infrastructure","requires_auth":"none","summary":"vantage6 servers include a default root account with weak credentials, allowing attackers to gain administrative access if not manually removed.","user_interaction":"not_required","vuln_class":"hardcoded_credentials"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-204","name":"Observable Response Discrepancy"},{"id":"CWE-1393","name":"Use of Default Password"}],"description":"vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `root`. This is not ideal because attackers know that almost all vantage6 servers have a user with username `root` that probably has admin rights, and the initial password is very weak and it is possible that administrators forget to reset it. Version 5.0.0 fixes the issue. As a workaround, it is possible to delete the `root` user after it has been used to create other users.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Vantage6: Set admin user and password from environment or configuration","id":"CVE-2026-54445","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"hardcoded_credentials","year":"2026"},"n_packages":3,"n_references":3,"next":{"headline":"NetLicensing MCP Server: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode","id":"CVE-2026-54446"},"packages":[{"ecosystem":"PyPI","fixed":["5.0.0"],"introduced":["0"],"last_affected":[],"package":"vantage6","purl":null,"source":"GHSA-fgmc-2hqj-86v4"},{"ecosystem":"PyPI","fixed":["5.0.0"],"introduced":["0"],"last_affected":[],"package":"vantage6","purl":"pkg:pypi/vantage6","source":"GHSA-fgmc-2hqj-86v4"},{"ecosystem":"PyPI","fixed":["5.0.0"],"introduced":["0"],"last_affected":[],"package":"vantage6","purl":"pkg:pypi/vantage6","source":"PYSEC-2026-3400"}],"prev":{"headline":"Dashy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)","id":"CVE-2026-54443"},"products":["vantage6"],"published":"2026-06-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-06-18","vendors":["vantage6"]},"summary":"vantage6 servers include a default root account with weak credentials, allowing attackers to gain administrative access if not manually removed.","url":"https://insights.sbomify.com/CVE-2026-54445/"}