PT-2026-7954 · Neuvector · Neuvector

Published 2026-02-12 · Updated 2026-03-03 · CVE-2025-67860

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NeuVector versions prior to 4.072

Description The NeuVector scanner insecurely handles passwords as command arguments. The scanner process accepts registry and controller credentials as command-line arguments, potentially exposing sensitive credentials to local users. This could allow unauthorized access to registries or the NeuVector controller, potentially enabling image manipulation, information disclosure, or further lateral movement within the environment. The impact severity for confidentiality, integrity and availability is dependent on the permissions the leaked credentials have on their services.

Recommendations Upgrade to NeuVector scanner version 4.072 or later.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2025-67860

GHSA-3C9M-GQ32-G4JX

GO-2026-4490

SUSE-SU-2026:0757-1

Affected Products

Neuvector

References · 119

• https://nvd.nist.gov/vuln/detail/CVE-2025-67860 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67860 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4490 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3c9m-gq32-g4jx · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://github.com/harvester/harvester/security/advisories/GHSA-3c9m-gq32-g4jx · Note
• https://github.com/neuvector/scanner/commit/c2f0f9268468e49eb3addea923156123c4465794 · Note
• https://github.com/neuvector/scanner · Note
• https://github.com/neuvector/scanner/security/advisories/GHSA-3c9m-gq32-g4jx · Note
• https://github.com/neuvector/scanner/releases/tag/v4.072 · Note
• https://suse.com/security/cve/CVE-2026-27112 · Note
• https://suse.com/security/cve/CVE-2026-27017 · Note
• https://suse.com/security/cve/CVE-2026-25229 · Note
• https://suse.com/security/cve/CVE-2026-23989 · Note
• https://suse.com/security/cve/CVE-2017-18906 · Note