CVEvulnerability

CVE-2025-8077

9.8 CRITICAL Published 2025-09-17 Modified 2026-10-18 Official page ↗
Status
Deferred
Published
2025-09-17
Last modified
2026-10-18
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1393

Description

A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.

Related

Weakness · CWE (1)

  • CWE-1393 Use of Default Password weakness

References