PT-2026-7954 · Neuvector · Neuvector

CVE-2025-67860 · Publicado 2026-02-12 · Atualizado 2026-03-03

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NeuVector versions prior to 4.072

Description The NeuVector scanner insecurely handles passwords as command arguments. The scanner process accepts registry and controller credentials as command-line arguments, potentially exposing sensitive credentials to local users. This could allow unauthorized access to registries or the NeuVector controller, potentially enabling image manipulation, information disclosure, or further lateral movement within the environment. The impact severity for confidentiality, integrity and availability is dependent on the permissions the leaked credentials have on their services.

Recommendations Upgrade to NeuVector scanner version 4.072 or later.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2025-67860

GHSA-3C9M-GQ32-G4JX

GO-2026-4490

SUSE-SU-2026:0757-1

Produtos afetados

Neuvector

Referências · 119

• https://github.com/harvester/harvester/security/advisories/GHSA-3c9m-gq32-g4jx · Nota
• https://github.com/neuvector/scanner/commit/c2f0f9268468e49eb3addea923156123c4465794 · Nota
• https://github.com/neuvector/scanner · Nota
• https://github.com/neuvector/scanner/security/advisories/GHSA-3c9m-gq32-g4jx · Nota
• https://github.com/neuvector/scanner/releases/tag/v4.072 · Nota
• https://suse.com/security/cve/CVE-2026-27112 · Nota
• https://suse.com/security/cve/CVE-2026-27017 · Nota
• https://suse.com/security/cve/CVE-2026-25229 · Nota
• https://suse.com/security/cve/CVE-2026-23989 · Nota
• https://suse.com/security/cve/CVE-2017-18906 · Nota
• https://suse.com/security/cve/CVE-2026-25934 · Nota
• https://suse.com/security/cve/CVE-2026-26995 · Nota
• https://suse.com/security/cve/CVE-2026-23632 · Nota
• https://t.me/cveNotify/153138 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2026-26313 · Nota