Loading...
Skip to main content
GeekWala

CVE-2025-66001 — Vulnerability in github.com/neuvector/neuvector —...

HIGH

NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)

Published December 12, 2025Updated September 10, 2026Source: osv

Summary

### Impact NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks. Starting from version 5.4.0, NeuVector supports TLS verification for following connection types: - Registry Connections - Auth Server Connections (SAML, LDAP and OIDC) - Webhook Connections By default, TLS verification remains disabled, and its configuration is located under **Settings > Configuration in the NeuVector UI**. In the patched version, the new NeuVector deployment enables TLS verification by default. For rolling upgrades, NeuVector does not automatically change this setting to prevent disruptions. **Note:** When "TLS verification" is enabled, it affects all connections to: - Registry servers - Auth servers (SAML, LDAP and OIDC) - Webhook servers ### Patches Patched versions include release v5.4.8 and above. ### Workarounds To manually enable TLS verification: 1. Open the NeuVector UI. 2. Navigate to **Settings > Configuration**. 3. In the **TLS Self-Signed Certificate Configuration** section, select **Enable TLS verification**. 4. (Optional) Upload or paste the **TLS self-signed certificate**. ### References If you have any questions or comments about this advisory: - Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries. - Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository. - Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).

Advisory Timeline

  • First published December 12, 2025 (304 days ago).
  • Last revised September 10, 2026 — 271 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update github.com/neuvector/neuvector to 5.4.8 or later
go get github.com/neuvector/neuvector@v5.4.8

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/neuvector/neuvector
go
All versions5.4.8

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-295
    Improper Certificate ValidationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2025-66001?
NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM) This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2025-66001?
CVE-2025-66001 affects github.com/neuvector/neuvector. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-66001 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-4jj9-cgqc-x9h5
GO-2025-4235

Related CVEs

  • CVE-2023-32188
    CRITICAL

    JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

  • CVE-2025-8077
    CRITICAL

    NeuVector admin account has insecure default password

  • CVE-2025-54469
    CRITICAL

    NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow

  • CVE-2026-107809
    HIGH

    Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

  • CVE-2026-107813
    HIGH

    Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

  • CVE-2025-54470
    HIGH

    NeuVector telemetry sender is vulnerable to MITM and DoS

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies