Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. vantage6
  4. ›
  5. GHSA-fgmc-2hqj-86v4

GHSA-fgmc-2hqj-86v4: Vantage6: Set admin user and password from environment or configuration

June 5, 2026

Vantage6 currently provides an initial user with username root and password root. This is not ideal for the following reasons:

  • Attackers know that almost all vantage6 servers have a user with username root that probably has admin rights
  • The initial password is very weak and it is possible that administrators forget to reset it.

References

  • github.com/advisories/GHSA-fgmc-2hqj-86v4
  • github.com/vantage6/vantage6/issues/1932
  • github.com/vantage6/vantage6/security/advisories/GHSA-fgmc-2hqj-86v4

Code Behaviors & Features

Detect and mitigate GHSA-fgmc-2hqj-86v4 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 5.0.0

Fixed versions

  • 5.0.0

Solution

Upgrade to version 5.0.0 or above.

Impact 7.3 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Learn more about CVSS

Weakness

  • CWE-1393: Use of Default Password
  • CWE-204: Observable Response Discrepancy

Source file

pypi/vantage6/GHSA-fgmc-2hqj-86v4.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 06 Jun 2026 12:17:43 +0000.