9.8
Critique
CVE-2025-8077 A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default…
Description
A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| neuvector 5.0 | 5.0.0 → < 5.4.6 | 5.4.6 |
Références
- bugzilla.suse.com bugzilla.suse.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de neuvector
Les 14 CVE de neuvector →
CVE-2026-78424
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write)…
8.8
Élevée
CVE-2026-78426
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field
2.0
Faible
CVE-2026-78428
For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving…
8.8
Élevée
CVE-2025-46808
An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive…
6.8
Moyenne