CVE-2026-78424
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced…
- Risk score
- 55/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise o…
- Affected
- See advisory
- Fix
- Upgrade the product to 5.4.11, 5.5.4 or 5.6.2 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.8 high
References
Original description
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions.
Last activity 28 Sep 2026. Patch Forecast updates every hour.