CVE-2025-8077
published 2025-09-17CVE-2025-8077: A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account…
PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.52%
40.2th percentile
A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | neuvector_neuvector | >= 5.0.0 < 5.4.6 | 5.4.6 |
| suse | neuvector | >= 5.0.0 < 5.4.6 | 5.4.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
NeuVector admin account has insecure default password in github.com/neuvector/neuvector
osv·2025-09-08
CVE-2025-8077 NeuVector admin account has insecure default password in github.com/neuvector/neuvector
NeuVector admin account has insecure default password in github.com/neuvector/neuvector
NeuVector admin account has insecure default password in github.com/neuvector/neuvector.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/neuvector/neuvector from v5.0.0 before v5.4.6.
GHSA
NeuVector admin account has insecure default password
ghsa·2025-08-28
CVE-2025-8077 [CRITICAL] CWE-1393 NeuVector admin account has insecure default password
NeuVector admin account has insecure default password
### Impact
A vulnerability exists in NeuVector versions up to and including **5.4.5**, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.
In earlier versions, NeuVector supports setting the default (bootstrap) password for the `admin` account using a Kubernetes Secret named `neuvector-bootstrap-secret`. This Secret must contain a key named `bootstrapPassword`. However, if NeuVector fails to retrieve this value, it falls back to the fixed default p
OSV
NeuVector admin account has insecure default password
osv·2025-08-28
CVE-2025-8077 [CRITICAL] NeuVector admin account has insecure default password
NeuVector admin account has insecure default password
### Impact
A vulnerability exists in NeuVector versions up to and including **5.4.5**, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.
In earlier versions, NeuVector supports setting the default (bootstrap) password for the `admin` account using a Kubernetes Secret named `neuvector-bootstrap-secret`. This Secret must contain a key named `bootstrapPassword`. However, if NeuVector fails to retrieve this value, it falls back to the fixed default p
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-17
Published