NeuVector versions up to 5.4.9 have a vulnerability where the manager /network/graph API lacks proper authentication controls. This flaw can cause sensitive information to be leaked through cached data accessible without authentication. The vulnerability is classified under CWE-306, indicating missing authentication for a critical function, and is associated with other weaknesses CWE-524 (Information Exposure Through Cached Data) and CWE-202 (Improper Access Control). The CVSS 3.1 base score is 7.3, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

An attacker can potentially access sensitive information from the NeuVector manager's /network/graph API without authentication due to missing access controls. This exposure can lead to information leakage affecting confidentiality, integrity, and availability of the system. The vulnerability does not require privileges or user interaction to exploit, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints through network controls or other compensating controls to prevent unauthorized access.