fr Sign in

6.5 Medium

CVE-2025-54471 NeuVector used a hard-coded cryptographic key embedded in the source code

Description

NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations when NeuVector stores the data.

Affected products and versions

Product	Affected versions	Fixed in
neuvector 5.3	5.3.0 → < 5.4.7	5.4.7
neuvector 0.0	0.0.0-20230727023453-1c4957d53911 → < 0.0.0-20251020133207-084a437033b4	0.0.0-20251020133207-084a437033b4

References

bugzilla.suse.com bugzilla.suse.com
github.com github.com

Timeline

Published October 30, 2025
Last modified October 30, 2025

The 14 CVEs of neuvector →

CVE-2026-78424 Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write)… 8.8 High CVE-2026-78426 The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field 2.0 Low CVE-2026-78428 For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving… 8.8 High CVE-2025-46808 An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive… 6.8 Medium

Track this CVE