EUVD-2025-210877Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Network-accessible manager, low-privilege authenticated trigger, user action required; scope change reflects downstream secret exposure; no integrity or availability impact.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
2DescriptionCVE.org
An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log
This issue affects neuvector: before 5.4.5.
AnalysisAI
Sensitive information disclosure in SUSE NeuVector Manager before version 5.4.5 exposes security-critical data by inserting it into the manager container's log files during normal or error-path operation. The scope-changed CVSS vector (S:C) indicates the leaked material - likely credentials, tokens, or API keys - can compromise systems beyond NeuVector itself. No public exploit has been identified at time of analysis, but the low privilege bar and high confidentiality impact make this a meaningful risk for Kubernetes environments where NeuVector is deployed.
Technical ContextAI
NeuVector is SUSE's container-native security platform; the manager component provides the central policy-enforcement console and orchestrates security controls across Kubernetes clusters. CWE-532 (Insertion of Sensitive Information into Log File) identifies the root cause as the application writing security-sensitive runtime data - such as authentication tokens, credentials, or internal API secrets - into log streams that are accessible to users or processes with container log-read permissions. The affected product is captured under CPE cpe:2.3:a:suse:neuvector:*:*:*:*:*:*:*:*, covering all NeuVector releases prior to 5.4.5. Log access in Kubernetes environments is typically controlled via RBAC on the kubectl logs verb, but centralized log aggregation pipelines (Fluentd, Loki, ELK) may broaden the exposure surface considerably.
RemediationAI
Upgrade NeuVector Manager to version 5.4.5 or later, which is the vendor-confirmed fixed release per GitHub Security Advisory GHSA-fggw-hv56-8m6r. Following the upgrade, rotate any credentials, API tokens, or secrets that may have been written to manager container logs during the exposure window - this is critical if log pipelines were accessible to non-administrative users or external log aggregation services. As a compensating control prior to patching, restrict kubectl logs access on the NeuVector manager pod via Kubernetes RBAC, removing that verb from non-administrator roles; note this may limit debugging capability. Additionally, audit log aggregation pipelines (Fluentd, Loki, ELK) to confirm that manager container log streams are not forwarded to tenants or lower-trust targets.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today