PT-2026-1506 · Suse · Suse Virtualization

Published 2026-01-05 · Updated 2026-01-17 · CVE-2025-62877

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SUSE Virtualization (Harvester) versions 1.5.x through 1.6.x

Description The interactive installer for SUSE Virtualization (Harvester) may expose the default OS SSH login password when creating a new cluster or adding hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is used with the Harvester configuration setup.

Recommendations Utilize the PXE boot mechanism along with the Harvester configuration setup to avoid this issue.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2025-62877

GHSA-6G8Q-HP2J-GVWV

GO-2026-4281

SUSE-SU-2026:0142-1

Affected Products

Suse Virtualization

References · 46

• https://osv.dev/vulnerability/GHSA-6g8q-hp2j-gvwv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62877 · Security Note
• https://osv.dev/vulnerability/GO-2026-4281 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0142-1 · Vendor Advisory
• https://github.com/harvester/harvester · Note
• https://github.com/harvester/harvester/security/advisories/GHSA-6g8q-hp2j-gvwv · Note
• https://suse.com/security/cve/CVE-2025-15107 · Note
• https://suse.com/security/cve/CVE-2025-63389 · Note
• https://suse.com/security/cve/CVE-2025-14987 · Note
• https://suse.com/security/cve/CVE-2025-14273 · Note
• https://suse.com/security/cve/CVE-2025-69413 · Note
• https://suse.com/security/cve/CVE-2024-6717 · Note
• https://t.me/cveNotify/148066 · Telegram Post
• https://suse.com/security/cve/CVE-2017-18897 · Note