Vulnerability · Published Sep 17, 2025 · Assigned by suse
CVE-2025-8077NeuVector admin account has insecure default password
Critical 9.8
In plain English
A critical-severity security flaw in neuvector from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/neuvector/neuvector | 0.0.0-20250825191744-da1a462074c3 | GHSA-8pxw-9c75-6w56 |
| Go | github.com/neuvector/neuvector | no fix listed | GO-2025-3918 |
Affected products (as reported)
Weakness: CWE-1393 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H