Executive brief
Vantage6, a framework for privacy-preserving federated learning, uses a default administrative account with a well-known username and password. If administrators do not manually change these credentials after installation, an attacker could gain full administrative control over the server. This could lead to unauthorized access to sensitive research data or disruption of the federated learning infrastructure.
Technical details
Vantage6 (specifically the server component) initializes a default administrative user with the hardcoded credentials 'root' for both the username and password. This vulnerability is classified under CWE-1393 (Use of Default Password). An attacker with network access to the Vantage6 server can authenticate as the root user without any prior privileges or user interaction. Once authenticated, the attacker gains full administrative rights, which can be used to manage users, organizations, and tasks. The issue is addressed in version 5.0.0 by allowing administrators to set the initial password via environment variables or configuration files.
Affected products
- vantage6 vantage6 <= 4.2.3
Timeline
- 2025-05-10: other: Issue tracking the fix for version 5.0 opened
- 2026-06-05: advisory: GitHub Advisory published
- 2026-06-05: patched: Version 5.0.0 released with fix