Is CVE-2026-54445 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54445 being exploited in the wild.

How severe is CVE-2026-54445?

Medium severity, with a CVSS score of 4, published 17 June 2026.

Which products and versions are affected?

vantage6 (PyPI) ECOSYSTEM:introduced=0,fixed=5.0.0.

Is there a fix for CVE-2026-54445?

Yes. vantage6 (PyPI): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54445 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54445?

Check whether you run vantage6 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54445: vantage6 use of default root credentials

CVE-2026-54445 · Severity: medium · CVSS 4 · Published 2026-06-17

vantage6, an open-source platform for privacy-preserving data analysis, contains a security weakness where new installations are configured with a default administrative account. Because this account uses a well-known username and password, unauthorized individuals can easily gain full control over the server if the administrator does not manually change these credentials. This could lead to the exposure of sensitive research data or unauthorized modification of the analysis infrastructure.

Technologies: vantage6 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54445 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54445 being exploited in the wild.
How severe is CVE-2026-54445?: Medium severity, with a CVSS score of 4, published 17 June 2026.
Which products and versions are affected?: vantage6 (PyPI) ECOSYSTEM:introduced=0,fixed=5.0.0.
Is there a fix for CVE-2026-54445?: Yes. vantage6 (PyPI): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54445 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54445?: Check whether you run vantage6 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vantage6 (PyPI): upgrade to 5.0.0 or later
```
pip install "vantage6>=5.0.0"
```

Technical details

vantage6 versions prior to 5.0.0 implement a default administrative user with the credentials 'root:root'. This vulnerability is classified as a Use of Default Password (CWE-1393). An attacker with network access to the vantage6 server can use these well-known credentials to authenticate as a superuser, gaining full administrative control over the infrastructure and hosted data. The issue is exacerbated by the fact that administrators may neglect to rotate these credentials post-deployment. The vulnerability is resolved in version 5.0.0; a workaround involves manually deleting the root user after creating alternative administrative accounts.

Affected products

vantage6 vantage6 < 5.0.0

Identifiers

CVE-2026-54445
GHSA-fgmc-2hqj-86v4
PYSEC-2026-3400

Timeline

2025-05-10: other: Issue tracked for major version 5.0 implementation
2026-06-05: advisory: GitHub Security Advisory published
2026-06-17: disclosed: CVE published to NVD
2026-06-17: patched: Version 5.0.0 released fixing the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.