Is CVE-2025-53884 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-53884 being exploited in the wild.

How severe is CVE-2025-53884?

Medium severity, with a CVSS score of 5.3, published 28 August 2025.

Which products and versions are affected?

github.com/neuvector/neuvector (Go) < 0.0.0-20250825191744-da1a462074c3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20250825191744-da1a462074c3; Suse NeuVector < 5.4.6.

Is there a fix for CVE-2025-53884?

Yes. github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250825191744-da1a462074c3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-53884 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-53884?

Check whether you run github.com/neuvector/neuvector (Go) or Suse NeuVector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-53884: SUSE NeuVector insecure password storage via unsalted hashes

Q: Is there a fix for CVE-2025-53884?

Yes. github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250825191744-da1a462074c3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-53884 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-53884?

Check whether you run github.com/neuvector/neuvector (Go) or Suse NeuVector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-53884 · Severity: medium · CVSS 5.3 · Published 2025-08-28

NeuVector, a container security platform, was found to store user passwords and API keys using insecure, unsalted hashes. If an attacker gains access to the underlying database, they could use precomputed tables to quickly crack these passwords and keys. This could lead to unauthorized access to the security management console and sensitive cloud infrastructure.

Technologies: github.com/neuvector/neuvector (Go), Suse NeuVector. Vendors: Go, Suse.

Quick answers

Is CVE-2025-53884 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-53884 being exploited in the wild.
How severe is CVE-2025-53884?: Medium severity, with a CVSS score of 5.3, published 28 August 2025.
Which products and versions are affected?: github.com/neuvector/neuvector (Go) < 0.0.0-20250825191744-da1a462074c3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20250825191744-da1a462074c3; Suse NeuVector < 5.4.6.
Is there a fix for CVE-2025-53884?: Yes. github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250825191744-da1a462074c3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-53884 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-53884?: Check whether you run github.com/neuvector/neuvector (Go) or Suse NeuVector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250825191744-da1a462074c3 or later
```
go get github.com/neuvector/neuvector@v0.0.0-20250825191744-da1a462074c3
```

Technical details

NeuVector was identified as using insecure password storage (CWE-759, CWE-916) by utilizing unsalted hashes for user credentials and API keys. This lack of salting allows for efficient offline cracking using rainbow tables if the hash data is exfiltrated. The vulnerability is addressed in version 5.4.6 by implementing PBKDF2 with a cryptographically secure 16-character salt. Post-patch, users must re-authenticate and API keys must be used at least once to trigger the regeneration of hashes using the new secure method.

Affected products

SUSE NeuVector < 5.4.6

Identifiers

CVE-2025-53884
GHSA-8ff6-pc43-jwv3
GO-2025-3917

Timeline

2025-08-26: disclosed
2025-08-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.