# CVE-2025-8077: SUSE NeuVector insecure default password for admin account

Source: https://junglewise.ai/threats/cve-2025-8077-suse-neuvector-insecure-default-password-for-admin-account  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-28. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2025-8077 · Severity: critical · CVSS 9.8 · Published 2025-08-28

NeuVector, a container security platform, uses a predictable default password for its administrative account. If this password is not changed immediately after installation, an attacker with network access to the cluster can take full control of the NeuVector platform. This allows unauthorized users to modify security policies, access sensitive data, or disrupt protected workloads.

Technologies: [github.com/neuvector/neuvector (Go)](https://junglewise.ai/threats/technologies/github-com-neuvector-neuvector), [Suse NeuVector](https://junglewise.ai/threats/technologies/neuvector). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2025-8077 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-8077 being exploited in the wild.

**How severe is CVE-2025-8077?** Critical severity, with a CVSS score of 9.8, published 28 August 2025.

**Which products and versions are affected?** github.com/neuvector/neuvector (Go) < 0.0.0-20250825191744-da1a462074c3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20250825191744-da1a462074c3; Suse NeuVector <= 5.4.5.

**Is there a fix for CVE-2025-8077?** Yes. github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250825191744-da1a462074c3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-8077 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-8077?** Check whether you run github.com/neuvector/neuvector (Go) or Suse NeuVector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/neuvector/neuvector (Go): upgrade to 0.0.0-20250825191744-da1a462074c3 or later

  ```sh
  go get github.com/neuvector/neuvector@v0.0.0-20250825191744-da1a462074c3
  ```


## Technical details

A vulnerability in NeuVector (up to version 5.4.5) stems from the use of a hardcoded, fixed string as the default password for the 'admin' account. While the system supports bootstrapping a password via Kubernetes Secrets, it fails open by falling back to this fixed string if the secret is missing or inaccessible. An attacker with network access to the NeuVector API can use these default credentials to obtain an authentication token and perform any administrative operation. Version 5.4.6 resolves this by requiring specific RBAC permissions to manage secrets and automatically generating secure random passwords for new deployments.

## Affected products

- SUSE NeuVector <= 5.4.5

## Identifiers

- CVE-2025-8077
- GHSA-8pxw-9c75-6w56
- GO-2025-3918

## Timeline

- 2025-08-26: disclosed
- 2025-08-28: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/holyspectral](https://api.github.com/users/holyspectral)
- [https://github.com/holyspectral](https://github.com/holyspectral)
- [https://api.github.com/users/holyspectral/gists%7B/gist_id%7D](https://api.github.com/users/holyspectral/gists%7B/gist_id%7D)
- [https://api.github.com/users/holyspectral/repos](https://api.github.com/users/holyspectral/repos)
- [https://avatars.githubusercontent.com/u/11805094?v=4](https://avatars.githubusercontent.com/u/11805094?v=4)
- [https://api.github.com/users/holyspectral/events%7B/privacy%7D](https://api.github.com/users/holyspectral/events%7B/privacy%7D)

## Related threats

- [NeuVector OS command injection in packet-capture filter](https://junglewise.ai/threats/cve-2026-78424-improper-parameter-handling-in-neuvector-allows-any-authenticated)
- [NeuVector admission webhook policy bypass via hardcoded sidecar image exemption](https://junglewise.ai/threats/cve-2026-78427-neuvector-admission-webhook-policy-bypass-via-hardcoded-sidecar)
- [GO-2025-4235 - NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM) in github.com/neuvector/neuvector](https://junglewise.ai/threats/cve-2025-66001-neuvector-openid-connect-is-vulnerable-to-man-in-the-middle-mitm)
- [GO-2025-4043 - NeuVector is shipping cryptographic material into its binary in github.com/neuvector/neuvector](https://junglewise.ai/threats/cve-2025-54471-neuvector-is-shipping-cryptographic-material-into-its-binary)
- [SUSE NeuVector MITM and DoS in telemetry sender](https://junglewise.ai/threats/cve-2025-54470-suse-neuvector-mitm-and-dos-in-telemetry-sender)