8.6

CVE-2025-54470: suse neuvector Improper Certificate Validation

CVSS: 8.6v3.1HighDeferred
AliasesCGA-2359-27qj-45hmCGA-33vv-j866-73vqCGA-f2mj-mjjf-q8q4
Published 30-10-2025Last modified 30-10-2025
Open JSON

Vulnerability summary

CVE-2025-54470 is a high (CVSS 8.6) Improper Certificate Validation vulnerability in suse neuvector. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.9% of scored vulnerabilities.

Overall risk
34/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.6/10
010
High · v3.1 (CVE.org)
EPSS score
0.20%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3
OPENSUSE-SU-2025:15710-1OPENSUSE-SU-2026:21483-1CGA-3H4X-9RXW-M56H

Timeline

  1. 30-10-2025
    PublishedVulnerability first disclosed.
  2. 30-10-2025
    Last modifiedVulnerability information updated.

Description

This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server. In affected versions, NeuVector does not enforce TLS certificate verification when transmitting anonymous cluster data to the telemetry server. As a result, the communication channel is susceptible to man-in-the-middle (MITM) attacks, where an attacker could intercept or modify the transmitted data. Additionally, NeuVector loads the response of the telemetry server is loaded into memory without size limitation, which makes it vulnerable to a Denial of Service(DoS) attack

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.20%

Chance of exploitation in the next 30 days

Percentile

9%

Versus all other CVEs

30-day change

+0.01 pp

From 0.18% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard4 products
  • neuvector-scannerAll versions (No fix recorded)
  • neuvector-scanner-fipsAll versions (No fix recorded)
  • neuvector-scanner-taskAll versions (No fix recorded)
  • neuvector-scanner-task-fipsAll versions (No fix recorded)
Wolfi2 products
  • neuvector-scannerAll versions (No fix recorded)
  • neuvector-scanner-taskAll versions (No fix recorded)
Github.com/neuvector1 product
  • neuvector≥ 0.0.0-20230727023453-1c4957d53911, < 0.0.0-20251020133207-084a437033b4 | All versions (No fix recorded)
Suse1 product
  • neuvector≥ 5.3.0, < 5.3.5 | ≥ 5.4.0, < 5.4.7 | ≥ 0.0.0-20230727023453-1c4957d53911, < 0.0.0-20251020133207-084a437033b4

4 vendors · 8 products

References

7 links