Threats affecting pkg:github/neuvector

CVE-2026-78424 is an OS command injection vulnerability in SUSE NeuVector affecting versions before 5.4.11, 5.5.4, and 5.6.2. It allows authenticated users with specific write permissions or access to internal gRPC certificate keys to execute arbitrary OS commands in a privileged container, potentially compromising the entire worker node. The vulnerability has a high severity with a CVSS score of 8.8.

The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token validity expires.

CVE-2025-66001 is a high-severity vulnerability in SUSE NeuVector version 5.3.0 where TLS verification for OpenID Connect login authentication is not enforced by default. This improper certificate validation (CWE-295) allows attackers to perform man-in-the-middle (MITM) attacks, potentially compromising confidentiality, integrity, and availability of the system. Exploitation requires no privileges but does require user interaction during login. The vulnerability has a CVSS score of 8.8, indicating a high impact with network attack vector and low attack complexity. No known exploits are currently reported in the wild. European organizations using NeuVector 5.3.