Is CVE-2025-54467 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-54467 being exploited in the wild.

How severe is CVE-2025-54467?

Medium severity, with a CVSS score of 5.3, published 28 August 2025.

Which products and versions are affected?

github.com/neuvector/neuvector (Go) < 0.0.0-20250902144615-f9ddbdf42031, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20250902144615-f9ddbdf42031; Suse NeuVector < 5.4.6.

Is there a fix for CVE-2025-54467?

Yes. github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250902144615-f9ddbdf42031 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-54467 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-54467?

Check whether you run github.com/neuvector/neuvector (Go) or Suse NeuVector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-54467: SUSE NeuVector sensitive information disclosure in security event logs

Q: Is there a fix for CVE-2025-54467?

Yes. github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250902144615-f9ddbdf42031 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-54467 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-54467?

Check whether you run github.com/neuvector/neuvector (Go) or Suse NeuVector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-54467 · Severity: medium · CVSS 5.3 · Published 2025-08-28

NeuVector, a container security platform, may inadvertently record sensitive information like passwords in its security event logs. This occurs when a process (such as a Java application) is terminated for a rule violation and its command-line arguments contain credentials that do not match the platform's default redaction filters. If an unauthorized person gains access to these logs, they could obtain sensitive credentials, potentially leading to further unauthorized access to the environment.

Technologies: github.com/neuvector/neuvector (Go), Suse NeuVector. Vendors: Go, Suse.

Quick answers

Is CVE-2025-54467 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-54467 being exploited in the wild.
How severe is CVE-2025-54467?: Medium severity, with a CVSS score of 5.3, published 28 August 2025.
Which products and versions are affected?: github.com/neuvector/neuvector (Go) < 0.0.0-20250902144615-f9ddbdf42031, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20250902144615-f9ddbdf42031; Suse NeuVector < 5.4.6.
Is there a fix for CVE-2025-54467?: Yes. github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250902144615-f9ddbdf42031 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-54467 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-54467?: Check whether you run github.com/neuvector/neuvector (Go) or Suse NeuVector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250902144615-f9ddbdf42031 or later
```
go get github.com/neuvector/neuvector@v0.0.0-20250902144615-f9ddbdf42031
```

Technical details

NeuVector is vulnerable to information disclosure (CWE-522, CWE-549) because it may fail to redact sensitive credentials from process command-line arguments in security event logs. When the NeuVector enforcer terminates a process for a rule violation, it logs the full command; if the command contains passwords or tokens that fall outside the default regex pattern `(?i)(password|passwd|token)`, these secrets are stored in plain text. While users can add custom patterns via a Kubernetes ConfigMap, doing so extensively can cause performance degradation due to regex backtracking. The vulnerability is reachable over the network if an attacker can trigger process violations or view security events. The issue is resolved in NeuVector version 5.4.6.

Affected products

SUSE NeuVector < 5.4.6

Identifiers

CVE-2025-54467
GHSA-w54x-xfxg-4gxq
GO-2025-3919

Timeline

2025-08-26: disclosed
2025-08-28: advisory
2025-08-28: patched: Fixed in version 5.4.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.