CVE Feed

    Dashboard / CVE / CVE-2026-78425

    CVE-2026-78425

    Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is presented to NeuVector, NeuVector accepts it because the only thing distinguishing "an assertion for NeuVector" from "an assertion for the wiki" is the element, and the `NotInAudience` warning that reports the mismatch is never read.

    Published:Sep 17, 2026
    Last Modified:Sep 28, 2026
    EPS:Sep 17, 2026
    EPSS Score:0.00364
    CVSS Score:7.6

    Affected Products

    Vendor
    Neuvector
    Product
    Neuvector
    Vendor
    Suse
    Product
    Github.com Neuvector Neuvector

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-287 Improper Authentication

    Related CVEs

    CVE-2026-78427 (CVSS 5.3) — The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matc…
    CVE-2025-8077 (CVSS 9.8) — A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the de…
    CVE-2025-54467 (CVSS 5.3) — When a Java command with password parameters is executed and terminated by NeuVector for Process rule violatio…
    CVE-2025-53884 (CVSS 5.3) — NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainb…
    CVE-2023-32188 (CVSS 9.4) — A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, …
    CVE-2019-19747 (CVSS 9.8) — NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwor…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High