CVE-2025-62877
Harvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer
- State
- Published
- Severity
- 9.8 Critical
- Published
- Jan 8, 2026
- Updated
- Jan 8, 2026
- Reserved
- Oct 24, 2025
Description
Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | suse |
Weaknesses
- CWE-1188 Initialization of a Resource with an Insecure Default
Affected Products
| Product | Versions |
|---|---|
harvesterSUSE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.