# CVE-2026-54445: vantage6 use of default root credentials

Source: https://junglewise.ai/threats/cve-2026-54445-vantage6-use-of-default-root-credentials  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-54445 · Severity: medium · CVSS 4 · Published 2026-06-17

vantage6, an open-source platform for privacy-preserving data analysis, contains a security weakness where new installations are configured with a default administrative account. Because this account uses a well-known username and password, unauthorized individuals can easily gain full control over the server if the administrator does not manually change these credentials. This could lead to the exposure of sensitive research data or unauthorized modification of the analysis infrastructure.

Technologies: [vantage6 (PyPI)](https://junglewise.ai/threats/technologies/vantage6). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-54445 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54445 being exploited in the wild.

**How severe is CVE-2026-54445?** Medium severity, with a CVSS score of 4, published 17 June 2026.

**Which products and versions are affected?** vantage6 (PyPI) ECOSYSTEM:introduced=0,fixed=5.0.0.

**Is there a fix for CVE-2026-54445?** Yes. vantage6 (PyPI): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54445 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54445?** Check whether you run vantage6 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vantage6 (PyPI): upgrade to 5.0.0 or later

  ```sh
  pip install "vantage6>=5.0.0"
  ```


## Technical details

vantage6 versions prior to 5.0.0 implement a default administrative user with the credentials 'root:root'. This vulnerability is classified as a Use of Default Password (CWE-1393). An attacker with network access to the vantage6 server can use these well-known credentials to authenticate as a superuser, gaining full administrative control over the infrastructure and hosted data. The issue is exacerbated by the fact that administrators may neglect to rotate these credentials post-deployment. The vulnerability is resolved in version 5.0.0; a workaround involves manually deleting the root user after creating alternative administrative accounts.

## Affected products

- vantage6 vantage6 < 5.0.0

## Identifiers

- CVE-2026-54445
- GHSA-fgmc-2hqj-86v4
- PYSEC-2026-3400

## Timeline

- 2025-05-10: other: Issue tracked for major version 5.0 implementation
- 2026-06-05: advisory: GitHub Security Advisory published
- 2026-06-17: disclosed: CVE published to NVD
- 2026-06-17: patched: Version 5.0.0 released fixing the issue

## References

- [https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst](https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst)
- [https://github.com/vantage6/vantage6/issues/1932](https://github.com/vantage6/vantage6/issues/1932)
- [https://github.com/vantage6/vantage6/security/advisories/GHSA-fgmc-2hqj-86v4](https://github.com/vantage6/vantage6/security/advisories/GHSA-fgmc-2hqj-86v4)

## Related threats

- [PYSEC-2026-3703 - vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review](https://junglewise.ai/threats/cve-2026-73652-vantage6-algorithm-developer-can-edit-another-developer-s)
- [PYSEC-2026-2007 - vantage6 collaboration admins can extend their influence by expanding the collaboration](https://junglewise.ai/threats/cve-2024-32969-vantage6-collaboration-admins-can-extend-their-influence-by)
- [PYSEC-2026-2005 - vantage6 vulnerable to a username timing attack on recover password/MFA token](https://junglewise.ai/threats/cve-2024-24770-vantage6-vulnerable-to-a-username-timing-attack-on-recover)
- [PYSEC-2026-2004 - vantage6's CORS settings overly permissive](https://junglewise.ai/threats/cve-2024-23823-vantage6-s-cors-settings-overly-permissive)
- [PYSEC-2026-2008 - vantage6 vulnerable to username timing attack](https://junglewise.ai/threats/cve-2024-21671-vantage6-vulnerable-to-username-timing-attack)