Vulnerability · Published Sep 28, 2026 · Assigned by suse

CVE-2026-78424OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes

High 8.8

In plain English

A high-severity OS command injection in NeuVector from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.2%top 90.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions.

Affected products (as reported)

Vendor	Product	Versions
SUSE	NeuVector	0 – before 5.4.115.5.0 – before 5.5.45.6.0 – before 5.6.2

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/neuvector/neuvector/security/advisories/GHSA-vr77-8vmq-qfmj vendor-advisory