Executive brief
NeuVector is a container security platform that manages authentication for containerized environments. This vulnerability allows one user to receive another user's authenticated session when multiple users log in through SAML or OpenID Connect simultaneously due to improper handling of login state. An attacker could gain unauthorized access to another user's account, roles, and permissions without needing valid credentials.
Technical details
This is a session fixation/race condition vulnerability in NeuVector Manager's SSO authentication flow. The root cause is that all SAML and OIDC login attempts use a single fixed in-memory key ("samlSso") to store the JWT returned from the controller, causing concurrent authentication attempts to overwrite each other. When a browser retrieves its authentication token, it may receive the JWT from a different user's login attempt that was processed most recently. The vulnerability requires network access to the Manager's /token_auth_server endpoint and relies on timing of concurrent SSO logins; no authentication is required to trigger the race condition. An attacker can exploit this by initiating a SAML/OIDC login concurrently with a legitimate user to potentially receive that user's authenticated session. Patches are available in NeuVector versions 5.6.2, 5.5.4, and 5.4.11, which use unique UUIDs per login attempt to prevent session mixing.
Affected products
- NeuVector Manager <5.4.11, <5.5.4, <5.6.2
Timeline
- 2026-09-16: disclosed
- 2026-09-17: patched