The vulnerability identified as CVE-2025-54467 affects SUSE NeuVector version 5.0.0. When a Java command containing password parameters is executed and then terminated by NeuVector due to a process rule violation, the password is recorded in the NeuVector security event log. This constitutes insufficient protection of credentials (CWE-522), potentially exposing sensitive password information in logs accessible to users or attackers with log access. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality only.

The primary impact is the exposure of passwords in security event logs, which could allow unauthorized users with access to these logs to obtain sensitive credential information. There is no direct impact on integrity or availability. The vulnerability does not require privileges or user interaction to be triggered, but exploitation depends on access to the logs where the password is recorded.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should restrict access to NeuVector security event logs to trusted personnel only and avoid passing sensitive passwords as command parameters where possible.