8.8
Élevée
CVE-2025-66001 NeuVector supports login authentication through OpenID Connect
Description
NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| neuvector 5.3 | 5.3.0 → < 5.4.8 | 5.4.8 |
Références
- bugzilla.suse.com bugzilla.suse.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de neuvector
Les 14 CVE de neuvector →
CVE-2026-78424
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write)…
8.8
Élevée
CVE-2026-78426
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field
2.0
Faible
CVE-2026-78428
For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving…
8.8
Élevée
CVE-2025-46808
An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive…
6.8
Moyenne