---
id: CVE-2026-78427
title: >-
  The NeuVector admission webhook silently excludes containers from policy
  evaluation when their image path matches one of three hardcoded service mesh
  sidecar images
summary: >-
  The NeuVector admission webhook silently excludes containers from policy
  evaluation when their image path matches one of three hardcoded service mesh
  sidecar images. Since the image path is entirely controlled by the workload
  author, any…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-807
vendor: go
product: github.com/neuvector/neuvector
affected:
  - github.com/neuvector/neuvector <= v5.6.1
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:07:38.320'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78427'
references:
  - url: 'https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-78427'
    label: meissner@suse.de
  - url: >-
      https://github.com/neuvector/neuvector/security/advisories/GHSA-78r4-3wfq-r2xm
    label: meissner@suse.de
tags:
  - nvd
  - cve.org
epss: 0.00357
epssPercentile: 0.29443
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T12:10:23.202569Z'
ingestedAt: '2026-09-17T10:15:37.164Z'
---

## Overview

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.