All vulnerabilities
CVE-2026-78424GHSA-vr77-8vmq-qfmj

NeuVector: OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes

SUSE NeuVector
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.4.11Also 5.5.4, 5.6.2CVE List
Published28 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

  • 5.4.11NeuVectorCVE List
  • 5.5.4NeuVectorCVE List
  • 5.6.2NeuVectorCVE List
  • 5.6.2github.com/neuvector/neuvector, goGitHubgo get github.com/neuvector/neuvector@v5.6.2
  • 5.5.4github.com/neuvector/neuvector, goGitHubgo get github.com/neuvector/neuvector@v5.5.4
  • 5.4.11github.com/neuvector/neuvector, goGitHubgo get github.com/neuvector/neuvector@v5.4.11

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions.

Text from CVE List

Affected versions 4

  • NeuVectoraffected: all versions before 5.4.11CVE List
  • NeuVectoraffected: 5.5.0 before 5.5.4CVE List
  • NeuVectoraffected: 5.6.0 before 5.6.2CVE List
  • github.com/neuvector/neuvector, go<=v5.6.1GitHub

References 1