Is CVE-2025-8077 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-8077 being exploited in the wild.

How severe is CVE-2025-8077?

Critical severity, with a CVSS score of 9.8, published 28 August 2025.

Which products and versions are affected?

github.com/neuvector/neuvector (Go) < 0.0.0-20250825191744-da1a462074c3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20250825191744-da1a462074c3; Suse NeuVector <= 5.4.5.

Is there a fix for CVE-2025-8077?

Yes. github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250825191744-da1a462074c3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-8077 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-8077?

Check whether you run github.com/neuvector/neuvector (Go) or Suse NeuVector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-8077: SUSE NeuVector insecure default password for admin account

Q: Is there a fix for CVE-2025-8077?

Yes. github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250825191744-da1a462074c3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-8077 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-8077?

Check whether you run github.com/neuvector/neuvector (Go) or Suse NeuVector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-8077 · Severity: critical · CVSS 9.8 · Published 2025-08-28

NeuVector, a container security platform, uses a predictable default password for its administrative account. If this password is not changed immediately after installation, an attacker with network access to the cluster can take full control of the NeuVector platform. This allows unauthorized users to modify security policies, access sensitive data, or disrupt protected workloads.

Technologies: github.com/neuvector/neuvector (Go), Suse NeuVector. Vendors: Go, Suse.

Quick answers

Is CVE-2025-8077 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-8077 being exploited in the wild.
How severe is CVE-2025-8077?: Critical severity, with a CVSS score of 9.8, published 28 August 2025.
Which products and versions are affected?: github.com/neuvector/neuvector (Go) < 0.0.0-20250825191744-da1a462074c3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20250825191744-da1a462074c3; Suse NeuVector <= 5.4.5.
Is there a fix for CVE-2025-8077?: Yes. github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250825191744-da1a462074c3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-8077 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-8077?: Check whether you run github.com/neuvector/neuvector (Go) or Suse NeuVector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250825191744-da1a462074c3 or later
```
go get github.com/neuvector/neuvector@v0.0.0-20250825191744-da1a462074c3
```

Technical details

A vulnerability in NeuVector (up to version 5.4.5) stems from the use of a hardcoded, fixed string as the default password for the 'admin' account. While the system supports bootstrapping a password via Kubernetes Secrets, it fails open by falling back to this fixed string if the secret is missing or inaccessible. An attacker with network access to the NeuVector API can use these default credentials to obtain an authentication token and perform any administrative operation. Version 5.4.6 resolves this by requiring specific RBAC permissions to manage secrets and automatically generating secure random passwords for new deployments.

Affected products

SUSE NeuVector <= 5.4.5

Identifiers

CVE-2025-8077
GHSA-8pxw-9c75-6w56
GO-2025-3918

Timeline

2025-08-26: disclosed
2025-08-28: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.