9.4
Critical
CVE-2023-22644 A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging…
Description
A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| neuvector 0.0 | earliest → < 0.0.0-20231003121714-be746957ee7c | 0.0.0-20231003121714-be746957ee7c |
References
- bugzilla.suse.com bugzilla.suse.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of neuvector
The 14 CVEs of neuvector →
CVE-2026-78424
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write)…
8.8
High
CVE-2026-78426
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field
2.0
Low
CVE-2026-78428
For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving…
8.8
High
CVE-2025-46808
An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive…
6.8
Medium