# CVE-2026-78427: NeuVector admission webhook policy bypass via hardcoded sidecar image exemption

Source: https://junglewise.ai/threats/cve-2026-78427-neuvector-admission-webhook-policy-bypass-via-hardcoded-sidecar  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78427 · Severity: medium · CVSS 4.3 · Published 2026-09-17

NeuVector is a container security platform that uses an admission webhook to enforce security policies on Kubernetes workloads. The webhook contains a vulnerability where it automatically exempts three hardcoded service mesh sidecar image names from policy evaluation. An attacker with workload deployment privileges can bypass admission denial rules by simply naming their container image to match one of these exempted sidecar images, allowing unauthorized containers to run without security policy enforcement.

Technologies: [Suse NeuVector](https://junglewise.ai/threats/technologies/neuvector). Vendors: [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-78427 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78427 being exploited in the wild.

**How severe is CVE-2026-78427?** Medium severity, with a CVSS score of 4.3, published 17 September 2026.

**Which products and versions are affected?** Suse NeuVector <=5.6.1.

**Is there a fix for CVE-2026-78427?** A patch was published on 2026-09-17: Patched in v5.6.2, v5.5.4, v5.4.11 and above Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78427 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-78427?** Check whether you run Suse NeuVector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reliance on untrusted inputs in a security decision (CWE-807). The NeuVector admission webhook checks container image paths against three hardcoded sidecar image names and silently exempts matching containers from policy evaluation. Since the image path is entirely controlled by the workload author (a user deploying to Kubernetes), any user with deployment privileges can craft a malicious container image with a path matching one of the hardcoded exemptions to bypass admission deny rules. The attack requires low privileges (ability to deploy workloads) and no user interaction, with a network attack vector against the webhook. Patches are available in NeuVector v5.6.2, v5.5.4, v5.4.11 and later, which remove the automatic sidecar exemptions entirely.

## Affected products

- SUSE NeuVector <=5.6.1

## Timeline

- 2026-09-16: disclosed
- 2026-09-17: patched: Patched in v5.6.2, v5.5.4, v5.4.11 and above

## References

- [https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-78427](https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-78427)
- [https://github.com/neuvector/neuvector/security/advisories/GHSA-78r4-3wfq-r2xm](https://github.com/neuvector/neuvector/security/advisories/GHSA-78r4-3wfq-r2xm)

## Related threats

- [NeuVector OS command injection in packet-capture filter](https://junglewise.ai/threats/cve-2026-78424-improper-parameter-handling-in-neuvector-allows-any-authenticated)
- [SUSE NeuVector MITM and DoS in telemetry sender](https://junglewise.ai/threats/cve-2025-54470-suse-neuvector-mitm-and-dos-in-telemetry-sender)
- [SUSE NeuVector insecure default password for admin account](https://junglewise.ai/threats/cve-2025-8077-suse-neuvector-insecure-default-password-for-admin-account)
- [SUSE NeuVector sensitive information disclosure in security event logs](https://junglewise.ai/threats/cve-2025-54467-suse-neuvector-sensitive-information-disclosure-in-security-event)
- [SUSE NeuVector insecure password storage via unsalted hashes](https://junglewise.ai/threats/cve-2025-53884-suse-neuvector-insecure-password-storage-via-unsalted-hashes)