NeuVector versions up to 5.4.9 have a missing authentication control on the manager's /network/graph API endpoint. This flaw allows unauthorized access to sensitive information cached by the API, potentially exposing confidential data. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), CWE-524 (Information Exposure Through Cached Data), and CWE-202 (Improper Access Control). The CVSS 3.1 base score is 7.3, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

The vulnerability can lead to unauthorized disclosure of sensitive information from the NeuVector manager's network graph API. This exposure could compromise confidentiality and potentially affect the integrity and availability of the system. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor SUSE's advisories for updates. Until a patch is available, restrict access to the affected API endpoint to trusted users and networks to reduce exposure.