CVE-2025-54471
published 2025-10-30CVE-2025-54471: NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.24%
15.3th percentile
NeuVector used a hard-coded cryptographic key embedded in the source
code. At compilation time, the key value was replaced with the secret
key value and used to encrypt sensitive configurations when NeuVector
stores the data.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | neuvector_neuvector | >= 0.0.0-20230727023453-1c4957d53911 < 0.0.0-20251020133207-084a437033b4 | 0.0.0-20251020133207-084a437033b4 |
| github.com | neuvector_neuvector | >= 5.3.0 < 5.4.7 | 5.4.7 |
| suse | neuvector | >= 0.0.0-20230727023453-1c4957d53911 < 0.0.0-20251020133207-084a437033b4 | 0.0.0-20251020133207-084a437033b4 |
| suse | neuvector | >= 5.3.0 < 5.4.7 | 5.4.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
NeuVector is shipping cryptographic material into its binary in github.com/neuvector/neuvector
osv·2025-10-30
CVE-2025-54471 NeuVector is shipping cryptographic material into its binary in github.com/neuvector/neuvector
NeuVector is shipping cryptographic material into its binary in github.com/neuvector/neuvector
NeuVector is shipping cryptographic material into its binary in github.com/neuvector/neuvector.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/neuvector/neuvector from v5.3.0 before v5.4.7.
OSV
NeuVector is shipping cryptographic material into its binary
osv·2025-10-21
CVE-2025-54471 [MEDIUM] NeuVector is shipping cryptographic material into its binary
NeuVector is shipping cryptographic material into its binary
### Impact
NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations when NeuVector stores the data.
In the patched version, NeuVector leverages the Kubernetes secret `neuvector-store-secret` in `neuvector` namespace to dynamically generate cryptographically secure random keys. This approach removes the reliance on static key values and ensures that encryption keys are managed securely within Kubernetes.
During rolling upgrade or restoring from persistent storage, the NeuVector controller checks each encrypted configured field. If a sensitive field in the configuration is found to be encrypted
GHSA
NeuVector is shipping cryptographic material into its binary
ghsa·2025-10-21
CVE-2025-54471 [MEDIUM] CWE-321 NeuVector is shipping cryptographic material into its binary
NeuVector is shipping cryptographic material into its binary
### Impact
NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations when NeuVector stores the data.
In the patched version, NeuVector leverages the Kubernetes secret `neuvector-store-secret` in `neuvector` namespace to dynamically generate cryptographically secure random keys. This approach removes the reliance on static key values and ensures that encryption keys are managed securely within Kubernetes.
During rolling upgrade or restoring from persistent storage, the NeuVector controller checks each encrypted configured field. If a sensitive field in the configuration is found to be encrypted
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-30
Published