CVE-2025-66001High· 8.8▾ TwilightNeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks. Starting from version 5.4.0, NeuVector supports TLS verification for following connection types:
By default, TLS verification remains disabled, and its configuration is located under Settings > Configuration in the NeuVector UI.
In the patched version, the new NeuVector deployment enables TLS verification by default. For rolling upgrades, NeuVector does not automatically change this setting to prevent disruptions.
Note: When "TLS verification" is enabled, it affects all connections to:
Patched versions include release v5.4.8 and above.
To manually enable TLS verification:
If you have any questions or comments about this advisory:
github.com/neuvector/neuvector >= 5.3.0, < 5.4.8Upgrade to a patched release:
github.com/neuvector/neuvector 5.4.8Connected by shared product, vendor, weakness, or advisory.
CVE-2023-32188CriticalJWT token compromise can allow malicious actions including Remote Code Execution (RCE)
CVE-2026-78425High· 7.6Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SS…
CVE-2026-78427Medium· 4.3The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images
CVE-2025-67860Low· 3.8NeuVector scanner insecurely handles passwords as command arguments