CVE-2025-8077: SUSE NeuVector insecure default password for admin account

Executive brief

NeuVector, a container security platform, uses a predictable default password for its administrative account. If this password is not changed immediately after installation, an attacker with network access to the cluster can take full control of the NeuVector platform. This allows unauthorized users to modify security policies, access sensitive data, or disrupt protected workloads.

Technical details

A vulnerability in NeuVector (up to version 5.4.5) stems from the use of a hardcoded, fixed string as the default password for the 'admin' account. While the system supports bootstrapping a password via Kubernetes Secrets, it fails open by falling back to this fixed string if the secret is missing or inaccessible. An attacker with network access to the NeuVector API can use these default credentials to obtain an authentication token and perform any administrative operation. Version 5.4.6 resolves this by requiring specific RBAC permissions to manage secrets and automatically generating secure random passwords for new deployments.

Affected products

• SUSE NeuVector <= 5.4.5

Timeline

• 2025-08-26: disclosed
• 2025-08-28: advisory: GitHub Advisory published

References

• https://api.github.com/users/holyspectral
• https://github.com/holyspectral
• https://api.github.com/users/holyspectral/gists%7B/gist_id%7D
• https://api.github.com/users/holyspectral/repos
• https://avatars.githubusercontent.com/u/11805094?v=4
• https://api.github.com/users/holyspectral/events%7B/privacy%7D