NeuVector version 5.0.0 uses an unsalted one-way hash to store user passwords and API keys. The lack of a salt makes these hashes vulnerable to rainbow table attacks, where precomputed hash values of common passwords can be used to reverse the hash and recover the original password or key. This vulnerability is identified as CWE-759 (Use of a One-Way Hash without a Salt). The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality only.

The vulnerability allows an attacker who obtains the hashed passwords or API keys to perform offline attacks using rainbow tables to recover the original credentials. This compromises the confidentiality of user credentials and API keys stored by NeuVector 5.0.0. There is no direct impact on integrity or availability reported.

No patch or official fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users should consider additional protective measures such as restricting access to stored hashes and monitoring for unauthorized access. Avoid relying solely on the affected version for sensitive environments.