CVE-2026-54445
Description
vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `root`. This is not ideal because attackers know that almost all vantage6 servers have a user with username `root` that probably has admin rights, and the initial password is very weak and it is possible that administrators forget to reset it. Version 5.0.0 fixes the issue. As a workaround, it is possible to delete the `root` user after it has been used to create other users.
Summary dbcve.org
vantage6 versions prior to 5.0.0 ship with a default administrator account using the username 'root' and password 'root'. This creates a predictable attack vector since attackers can target this well-known credential combination on any deployed vantage6 server, potentially gaining administrative access if administrators fail to change the default password.
Mitigation
Upgrade to vantage6 version 5.0.0 or later which eliminates the default credential, or alternatively delete the root user after using it to create other administrative accounts.