The NeuVector admission webhook silently bypasses policy evaluation for containers whose image path matches any of three hardcoded service mesh sidecar images. Since the image path is fully controlled by the workload author, any user able to deploy workloads can evade admission deny rules by simply naming their container image path to match one of these sidecar images. This constitutes a reliance on untrusted inputs in a security decision (CWE-807). The vulnerability affects versions >=0 and <5.6.2 of github.com/neuvector/neuvector. The CVSS 3.1 base score is 4.3 (medium severity) with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and low availability impact.

An attacker with the ability to deploy workloads can bypass admission deny rules by naming their container image path after one of the three hardcoded service mesh sidecar images. This allows evasion of policy enforcement, potentially enabling unauthorized or malicious containers to run without detection or restriction. The impact is limited to availability with no confidentiality or integrity impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict workload deployment privileges to trusted users only to reduce risk. Monitor vendor advisories for updates and apply official fixes once released.