CVE-2025-8077: NeuVector admin account has insecure default password

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-17 · updated 2026-10-18
Weakness: CWE-1393

Description

A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.

Affected products

SUSE neuvector: from 5.0.0 before 5.4.6 — fixed in 5.4.6

How to fix

Upgrade to a fixed version: SUSE neuvector 5.4.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-8077 or the next vulnerability affects your stack