Veille CVE

Recherche « SUSE neuvector »

7 CVE

Critique 0 Élevée 4 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « SUSE neuvector » ✕
  1. CVE-2026-78424 8.8 Élevée

    SUSE NeuVector

    Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions.

  2. CVE-2026-78428 8.8 Élevée

    SUSE neuvector

    For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

  3. CVE-2026-78427 5.3 Moyenne

    SUSE github.com/neuvector/neuvector

    The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.

  4. CVE-2026-78426 2.0 Faible

    SUSE neuvector

    The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token validity expires.

  5. CVE-2026-78425 7.6 Élevée

    SUSE github.com/neuvector/neuvector

    Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is presented to NeuVector, NeuVector accepts it because the only thing distinguishing "an assertion for NeuVector" from "an assertion for the wiki" is the element, and the `NotInAudience` warning that reports the mismatch is never read.

  6. CVE-2025-46808 6.8 Moyenne

    SUSE neuvector

    An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log This issue affects neuvector: before 5.4.5.

  7. CVE-2026-25703 7.3 Élevée

    SUSE NeuVector

    NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information.