Skip to content
fr Sign in
8.8 High

CVE-2026-78424 Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write)…

Description

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions.

Affected products and versions

Product Affected versions Fixed in
neuvector 5.6 5.6.0 → < 5.6.2 5.6.2
neuvector 5.5 5.5.0 → < 5.5.4 5.5.4
neuvector 5.4 earliest → < 5.4.11 5.4.11

References

Timeline

  1. Published
  2. Last modified

Other CVEs of neuvector

The 14 CVEs of neuvector →
CVE-2026-78426 The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field 2.0 Low CVE-2026-78428 For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving… 8.8 High CVE-2025-46808 An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive… 6.8 Medium CVE-2026-25703 NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing… 7.3 High
Track this CVE