9.8
Critical
CVE-2025-8077 A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default…
Description
A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| neuvector 5.0 | 5.0.0 → < 5.4.6 | 5.4.6 |
Other CVEs of neuvector
The 14 CVEs of neuvector →
CVE-2026-78424
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write)…
8.8
High
CVE-2026-78426
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field
2.0
Low
CVE-2026-78428
For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving…
8.8
High
CVE-2025-46808
An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive…
6.8
Medium