Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-78424

OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE NeuVector

Default version status: unaffected

  • 0 to < 5.4.11affected
  • 5.5.0 to < 5.5.4affected
  • 5.6.0 to < 5.6.2affected

References