Quick answers
- Is CVE-2026-78426 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78426 being exploited in the wild.
- How severe is CVE-2026-78426?
- Low severity, with a CVSS score of 3.7, published 17 September 2026.
- Which products and versions are affected?
- NeuVector NeuVector <=5.6.1.
- Is there a fix for CVE-2026-78426?
- A patch was published on 2026-09-17: Patched in v5.6.2, v5.5.4, v5.4.11 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78426 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-78426?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authentication bypass due to improper JWT signature validation. The NeuVector JWT verifier accepts multiple noncanonical (non-unique) Base64URL encodings of the same RSA signature field, allowing an attacker to craft alternative valid encodings of a logged-out token. An attacker with a valid, non-expired JWT that has been logged out can re-encode the signature and continue authenticated requests. The attack requires the attacker to hold a previously-valid token and user interaction to obtain it, but works across the network. Patches are available in NeuVector v5.6.2, v5.5.4, v5.4.11 and later, which enforce unique compact JWT serialization.
Affected products
- NeuVector NeuVector <=5.6.1
Timeline
- 2026-09-16: disclosed
- 2026-09-17: patched: Patched in v5.6.2, v5.5.4, v5.4.11 and later