Suse Neuvector vulnerabilities

13 CVEs affecting Suse Neuvector, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-78424, published 2026-09-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-25703, published 2026-08-05. High severity, CVSS 7.3. EPSS: 0.8% chance of exploitation in the next 30 days. NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information.
CVE-2023-32188, published 2024-10-16. Critical severity, CVSS 9.4. EPSS: 0.6% chance of exploitation in the next 30 days. A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead…
CVE-2025-8077, published 2025-09-17. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed…
CVE-2025-54469, published 2025-10-30. Critical severity, CVSS 9.9. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first…
CVE-2025-66001, published 2026-01-08. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by…
CVE-2025-54471, published 2025-10-30. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations …
CVE-2026-78428, published 2026-09-17. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur…
CVE-2025-54467, published 2025-09-17. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector security event log.
CVE-2025-46808, published 2026-09-09. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log This issue affects neuvector: before…
CVE-2025-54470, published 2025-10-30. High severity, CVSS 8.6. EPSS: 0.2% chance of exploitation in the next 30 days. This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry…

Latest

CVE-2026-78424, published 2026-09-28. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key…
CVE-2026-78426, published 2026-09-17. Low severity, CVSS 2.0. EPSS: 0.2% chance of exploitation in the next 30 days. The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can…