CVE-2026-25703

Potential information leakage from manager /network/graph API in NeuVector

NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Neuvector

CVE-2026-78424

OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Neuvector

CVE-2026-78428

Flaw in Neuvector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Go Suse

Products

Neuvector Neuvector

CVE-2026-78427

Admission Control Bypass via Hardcoded Sidecar Image Exemption

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Neuvector Suse

Products

Neuvector Github.com Neuvector Neuvector

CVE-2026-78426

Logout bypass via alternate JWT spelling

The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token validity expires.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Go Suse

Products

Neuvector Neuvector

CVE-2026-78425

SAML Audience Confusion Allows Cross-SP Authentication

Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is presented to NeuVector, NeuVector accepts it because the only thing distinguishing "an assertion for NeuVector" from "an assertion for the wiki" is the element, and the `NotInAudience` warning that reports the mismatch is never read.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Neuvector Suse

Products

Neuvector Github.com Neuvector Neuvector

CVE-2025-46808

Sensitive information is leaked into NeuVector’s manager container logs

An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log This issue affects neuvector: before 5.4.5.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Neuvector

CVE-2025-8077

NeuVector admin account has insecure default password

A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Neuvector Suse

Products

Neuvector Neuvector

CVE-2025-66001

NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)

NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Neuvector

CVE-2025-54471

NeuVector is shipping cryptographic material into its binary

NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations when NeuVector stores the data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Neuvector

CVE-2025-54470

NeuVector telemetry sender is vulnerable to MITM and DoS

This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server. In affected versions, NeuVector does not enforce TLS certificate verification when transmitting anonymous cluster data to the telemetry server. As a result, the communication channel is susceptible to man-in-the-middle (MITM) attacks, where an attacker could intercept or modify the transmitted data. Additionally, NeuVector loads the response of the telemetry server is loaded into memory without size limitation, which makes it vulnerable to a Denial of Service(DoS) attack

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Neuvector

CVE-2025-54469

NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow

A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values. The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the popen function to execute a shell command that determines whether the ports used by the consul subprocess are still active. The values of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT are used directly to compose shell commands via popen without validation or sanitization. This behavior could allow a malicious user to inject malicious commands through these variables within the enforcer container.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Neuvector

CVE-2025-54467

NeuVector process with sensitive arguments lead to leakage

When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector security event log.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Neuvector Suse

Products

Neuvector Neuvector

CVE-2025-53884

NeuVector has an insecure password storage vulnerable to rainbow attack

NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Neuvector Suse

Products

Neuvector Neuvector