# CVE-2025-54467: SUSE NeuVector sensitive information disclosure in security event logs

Source: https://junglewise.ai/threats/cve-2025-54467-suse-neuvector-sensitive-information-disclosure-in-security-event  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-28. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2025-54467 · Severity: medium · CVSS 5.3 · Published 2025-08-28

NeuVector, a container security platform, may inadvertently record sensitive information like passwords in its security event logs. This occurs when a process (such as a Java application) is terminated for a rule violation and its command-line arguments contain credentials that do not match the platform's default redaction filters. If an unauthorized person gains access to these logs, they could obtain sensitive credentials, potentially leading to further unauthorized access to the environment.

Technologies: [github.com/neuvector/neuvector (Go)](https://junglewise.ai/threats/technologies/github-com-neuvector-neuvector), [Suse NeuVector](https://junglewise.ai/threats/technologies/neuvector). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2025-54467 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-54467 being exploited in the wild.

**How severe is CVE-2025-54467?** Medium severity, with a CVSS score of 5.3, published 28 August 2025.

**Which products and versions are affected?** github.com/neuvector/neuvector (Go) < 0.0.0-20250902144615-f9ddbdf42031, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20250902144615-f9ddbdf42031; Suse NeuVector < 5.4.6.

**Is there a fix for CVE-2025-54467?** Yes. github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250902144615-f9ddbdf42031 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-54467 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-54467?** Check whether you run github.com/neuvector/neuvector (Go) or Suse NeuVector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250902144615-f9ddbdf42031 or later

  ```sh
  go get github.com/neuvector/neuvector@v0.0.0-20250902144615-f9ddbdf42031
  ```


## Technical details

NeuVector is vulnerable to information disclosure (CWE-522, CWE-549) because it may fail to redact sensitive credentials from process command-line arguments in security event logs. When the NeuVector enforcer terminates a process for a rule violation, it logs the full command; if the command contains passwords or tokens that fall outside the default regex pattern `(?i)(password|passwd|token)`, these secrets are stored in plain text. While users can add custom patterns via a Kubernetes ConfigMap, doing so extensively can cause performance degradation due to regex backtracking. The vulnerability is reachable over the network if an attacker can trigger process violations or view security events. The issue is resolved in NeuVector version 5.4.6.

## Affected products

- SUSE NeuVector < 5.4.6

## Identifiers

- CVE-2025-54467
- GHSA-w54x-xfxg-4gxq
- GO-2025-3919

## Timeline

- 2025-08-26: disclosed
- 2025-08-28: advisory
- 2025-08-28: patched: Fixed in version 5.4.6

## References

- [https://api.github.com/users/holyspectral](https://api.github.com/users/holyspectral)
- [https://github.com/holyspectral](https://github.com/holyspectral)
- [https://api.github.com/users/holyspectral/gists%7B/gist_id%7D](https://api.github.com/users/holyspectral/gists%7B/gist_id%7D)
- [https://api.github.com/users/holyspectral/repos](https://api.github.com/users/holyspectral/repos)
- [https://avatars.githubusercontent.com/u/11805094?v=4](https://avatars.githubusercontent.com/u/11805094?v=4)
- [https://api.github.com/users/holyspectral/events%7B/privacy%7D](https://api.github.com/users/holyspectral/events%7B/privacy%7D)

## Related threats

- [NeuVector OS command injection in packet-capture filter](https://junglewise.ai/threats/cve-2026-78424-improper-parameter-handling-in-neuvector-allows-any-authenticated)
- [NeuVector admission webhook policy bypass via hardcoded sidecar image exemption](https://junglewise.ai/threats/cve-2026-78427-neuvector-admission-webhook-policy-bypass-via-hardcoded-sidecar)
- [GO-2025-4235 - NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM) in github.com/neuvector/neuvector](https://junglewise.ai/threats/cve-2025-66001-neuvector-openid-connect-is-vulnerable-to-man-in-the-middle-mitm)
- [GO-2025-4043 - NeuVector is shipping cryptographic material into its binary in github.com/neuvector/neuvector](https://junglewise.ai/threats/cve-2025-54471-neuvector-is-shipping-cryptographic-material-into-its-binary)
- [SUSE NeuVector MITM and DoS in telemetry sender](https://junglewise.ai/threats/cve-2025-54470-suse-neuvector-mitm-and-dos-in-telemetry-sender)