← Back to the live CVE advisory feed

CVE-2026-78424: Product identification pending

Severity

8.8 (HIGH)

Vendor

SUSE

Affected versions

NeuVector 5.4 prior to 5.4.11; NeuVector 5.5 prior to 5.5.4; NeuVector 5.6 prior to 5.6.2; potentially older versions.

Fixed version

NeuVector 5.4.11, 5.5.4, 5.6.2

Patch status

Patched

Published

2026-09-28T12:17:40.897

Modified

2026-09-28T18:17:25.290

Why it matters

This vulnerability poses a critical risk to NeuVector deployments, enabling authenticated users with specific write permissions or internal gRPC certificate access to execute arbitrary OS commands within the privileged enforcer container. This can result in the complete compromise of the underlying

Recommended admin actions

• Identify and inventory all NeuVector instances running affected versions.
• Upgrade NeuVector to version 5.4.11, 5.5.4, or 5.6.2, matching your current major version.
• Review and restrict user permissions, especially those with namespaced Runtime Policies (write) access.
• Monitor NeuVector worker nodes for any unusual command execution or suspicious activity.

Technical summary

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions.

View the official NVD record for CVE-2026-78424

AI-enriched (HIGH confidence). Validate against the vendor advisory before taking production action.