CVE-2025-8077
NeuVector admin account has insecure default password
- State
- Published
- Severity
- 9.8 Critical
- Published
- Sep 17, 2025
- Updated
- Feb 26, 2026
- Reserved
- Jul 23, 2025
Description
A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | suse |
Weaknesses
- CWE-1393 Use of Default Password
Affected Products
| Product | Versions |
|---|---|
neuvectorSUSE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.