# CVE-2025-53884: SUSE NeuVector insecure password storage via unsalted hashes

Source: https://junglewise.ai/threats/cve-2025-53884-suse-neuvector-insecure-password-storage-via-unsalted-hashes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-28. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2025-53884 · Severity: medium · CVSS 5.3 · Published 2025-08-28

NeuVector, a container security platform, was found to store user passwords and API keys using insecure, unsalted hashes. If an attacker gains access to the underlying database, they could use precomputed tables to quickly crack these passwords and keys. This could lead to unauthorized access to the security management console and sensitive cloud infrastructure.

Technologies: [github.com/neuvector/neuvector (Go)](https://junglewise.ai/threats/technologies/github-com-neuvector-neuvector), [Suse NeuVector](https://junglewise.ai/threats/technologies/neuvector). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2025-53884 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-53884 being exploited in the wild.

**How severe is CVE-2025-53884?** Medium severity, with a CVSS score of 5.3, published 28 August 2025.

**Which products and versions are affected?** github.com/neuvector/neuvector (Go) < 0.0.0-20250825191744-da1a462074c3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20250825191744-da1a462074c3; Suse NeuVector < 5.4.6.

**Is there a fix for CVE-2025-53884?** Yes. github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250825191744-da1a462074c3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-53884 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-53884?** Check whether you run github.com/neuvector/neuvector (Go) or Suse NeuVector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250825191744-da1a462074c3 or later

  ```sh
  go get github.com/neuvector/neuvector@v0.0.0-20250825191744-da1a462074c3
  ```


## Technical details

NeuVector was identified as using insecure password storage (CWE-759, CWE-916) by utilizing unsalted hashes for user credentials and API keys. This lack of salting allows for efficient offline cracking using rainbow tables if the hash data is exfiltrated. The vulnerability is addressed in version 5.4.6 by implementing PBKDF2 with a cryptographically secure 16-character salt. Post-patch, users must re-authenticate and API keys must be used at least once to trigger the regeneration of hashes using the new secure method.

## Affected products

- SUSE NeuVector < 5.4.6

## Identifiers

- CVE-2025-53884
- GHSA-8ff6-pc43-jwv3
- GO-2025-3917

## Timeline

- 2025-08-26: disclosed
- 2025-08-28: advisory

## References

- [https://api.github.com/users/holyspectral](https://api.github.com/users/holyspectral)
- [https://github.com/holyspectral](https://github.com/holyspectral)
- [https://api.github.com/users/holyspectral/gists%7B/gist_id%7D](https://api.github.com/users/holyspectral/gists%7B/gist_id%7D)
- [https://api.github.com/users/holyspectral/repos](https://api.github.com/users/holyspectral/repos)
- [https://avatars.githubusercontent.com/u/11805094?v=4](https://avatars.githubusercontent.com/u/11805094?v=4)
- [https://api.github.com/users/holyspectral/events%7B/privacy%7D](https://api.github.com/users/holyspectral/events%7B/privacy%7D)

## Related threats

- [NeuVector OS command injection in packet-capture filter](https://junglewise.ai/threats/cve-2026-78424-improper-parameter-handling-in-neuvector-allows-any-authenticated)
- [NeuVector admission webhook policy bypass via hardcoded sidecar image exemption](https://junglewise.ai/threats/cve-2026-78427-neuvector-admission-webhook-policy-bypass-via-hardcoded-sidecar)
- [GO-2025-4235 - NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM) in github.com/neuvector/neuvector](https://junglewise.ai/threats/cve-2025-66001-neuvector-openid-connect-is-vulnerable-to-man-in-the-middle-mitm)
- [GO-2025-4043 - NeuVector is shipping cryptographic material into its binary in github.com/neuvector/neuvector](https://junglewise.ai/threats/cve-2025-54471-neuvector-is-shipping-cryptographic-material-into-its-binary)
- [SUSE NeuVector MITM and DoS in telemetry sender](https://junglewise.ai/threats/cve-2025-54470-suse-neuvector-mitm-and-dos-in-telemetry-sender)