CVE-2025-54467
published 2025-09-17CVE-2025-54467: When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.23%
13.9th percentile
When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector security event log.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | neuvector_neuvector | >= 5.0.0 < 5.4.6 | 5.4.6 |
| suse | neuvector | >= 5.0.0 < 5.4.6 | 5.4.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector
osv·2025-09-08
CVE-2025-54467 NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector
NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector
NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/neuvector/neuvector from v5.0.0 before v5.4.6.
GHSA
NeuVector process with sensitive arguments lead to leakage
ghsa·2025-08-28
CVE-2025-54467 [MEDIUM] CWE-522 NeuVector process with sensitive arguments lead to leakage
NeuVector process with sensitive arguments lead to leakage
### Impact
When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation. For example,
```
java -cp /app ... Djavax.net.ssl.trustStorePassword=
```
The command with the password appears in the NeuVector security event. To prevent this, NeuVector uses the following default regular expression to detect and redact sensitive data from process commands:
```
(?i)(password|passwd|token)
```
Also, you can define custom patterns to redact by creating a Kubernetes ConfigMap. For example:
```
kubectl create configmap neuvector-custom-rules --from-file=secret-patterns.yaml -n neuvector
```
Sample `secret-patterns.yaml` content:
```
Pattern_list:
- (?i)(pawd|pword)
- (?i)(secret)
```
N
OSV
NeuVector process with sensitive arguments lead to leakage
osv·2025-08-28
CVE-2025-54467 [MEDIUM] NeuVector process with sensitive arguments lead to leakage
NeuVector process with sensitive arguments lead to leakage
### Impact
When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation. For example,
```
java -cp /app ... Djavax.net.ssl.trustStorePassword=
```
The command with the password appears in the NeuVector security event. To prevent this, NeuVector uses the following default regular expression to detect and redact sensitive data from process commands:
```
(?i)(password|passwd|token)
```
Also, you can define custom patterns to redact by creating a Kubernetes ConfigMap. For example:
```
kubectl create configmap neuvector-custom-rules --from-file=secret-patterns.yaml -n neuvector
```
Sample `secret-patterns.yaml` content:
```
Pattern_list:
- (?i)(pawd|pword)
- (?i)(secret)
```
N
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-17
Published