What is the CVSS score of CVE-2026-25703?

CVE-2026-25703 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of NeuVector are affected by CVE-2026-25703?

NeuVector container security platform versions through 5.4.9 expose an unauthenticated API endpoint (/network/graph) that reveals Kubernetes service topology, container deployment details, and…

How to fix or mitigate CVE-2026-25703?

Within 24 hours, audit all NeuVector manager instances to confirm versions and verify if the endpoint is internet-facing or accessible from untrusted networks, immediately restrict network access to the /network/graph API using firewall rules to allow only trusted administrative networks, and enable logging for all API access attempts. Within 7 days, implement network segmentation to isolate the NeuVector manager from production Kubernetes clusters and untrusted subnets, review audit logs for any unauthorized API access, and deploy Web Application Firewall (WAF) rules to block requests to the /network/graph endpoint from non-administrative sources. Within 30 days, contact NeuVector support to establish patch timeline expectations, evaluate and implement alternative container security solutions if patches remain unavailable beyond 60 days, document all compensating controls in your security control matrix, and establish quarterly reviews of residual risk from this vulnerability.

NeuVector CVE-2026-25703

EUVD-2026-53297 HIGH

Exposure of Sensitive Information Through Data Queries (CWE-202)

2026-08-05 meissner@suse.de

Authentication Bypass

7.3

CVSS 3.1 · Vendor: suse

Severity by source

Vendor (suse) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.5 HIGH

Network-accessible unauthenticated endpoint leaks security-sensitive topology data (C:H); no integrity or availability impact is described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 10:31 vuln.today

CVE Published

Aug 05, 2026 - 10:17 cve.org

HIGH 7.3

DescriptionCVE.org

NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information.

AnalysisAI

Unauthenticated access to NeuVector's manager /network/graph API exposes cached network topology data in all versions through 5.4.9, allowing any network-reachable attacker to retrieve sensitive container environment details without credentials. The missing authentication on this endpoint (CWE-202) means the container security platform itself becomes a reconnaissance source, potentially revealing Kubernetes service relationships, container names, and network flow data to adversaries. No public exploit code or active exploitation (KEV) has been identified at time of analysis, but the unauthenticated network vector significantly lowers the bar for exploitation.

Technical ContextAI

NeuVector is a SUSE-maintained open-source container security platform that provides runtime protection, network visibility, and compliance enforcement for Kubernetes environments. Its manager component exposes a REST API and web UI for security operations. The /network/graph endpoint generates and caches network topology graphs depicting inter-container and inter-service communication flows - data that is inherently sensitive in a security product context. CWE-202 (Exposure of Sensitive Information Through Data Queries) identifies the root cause: the API endpoint lacks authentication middleware, so cached topology data - which may include container names, service endpoints, namespace mappings, and IP addressing - is returned to any client that issues a request. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms this is a direct network-accessible flaw with no preconditions or user interaction.

RemediationAI

Consult the GitHub Security Advisory GHSA-hx45-873x-74qv at https://github.com/neuvector/manager/security/advisories/GHSA-hx45-873x-74qv for the patched release version and upgrade the NeuVector manager beyond 5.4.9 as the primary fix - the exact patched version is not independently confirmed from the data available and must be verified there. As an immediate compensating control, restrict network access to the NeuVector manager API using Kubernetes NetworkPolicy or external firewall rules to allow only authorized management hosts and SIEM/monitoring systems, which eliminates external unauthenticated reach without disabling the service; note this reduces exposure but does not fix the missing authentication. If the manager API is not required to be accessible from broad internal segments, placing it behind a VPN or zero-trust access gateway adds a meaningful authentication layer upstream. Do not treat network restriction as equivalent to patching, as internal attackers or compromised workloads would still be able to reach the endpoint.