EUVD-2026-53297Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify NeuVector manager API endpoint
-
DeliverySend unauthenticated GET /network/graph request
-
ExploitReceive cached container network topology data
-
ExecutionMap Kubernetes services, namespaces, and container relationships
-
ImpactTarget high-value workloads for lateral movement
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V14 - Data Protection Sensitive data in outbound message
|
| Exploitation Conditions | The NeuVector manager service must be network-reachable from the attacker's position - no authentication, privileges, or user interaction are required, as confirmed by PR:N/UI:N in the CVSS vector. The endpoint must have cached network graph data, which is a normal operational condition for any active NeuVector deployment. Exploitation is limited to versions 5.4.1 through 5.4.9 (all versions up to and including 5.4.9). Environments that restrict the manager API to trusted management networks via firewall or NetworkPolicy are significantly harder to exploit, as network reachability is the only prerequisite. There is no requirement for a specific Kubernetes configuration or enabled feature beyond running the NeuVector manager in its default operational state. |
| Impact | The NVD CVSS 7.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates a straightforward, unauthenticated, network-accessible flaw with no complexity barriers. The PR:N and AC:L combination is consistent with the missing authentication finding. However, the assigned I:L and A:L impact ratings are not clearly supported by the description, which only describes information leakage - integrity and availability impacts may be overstated in the NVD scoring and should be verified with the vendor advisory (GHSA-hx45-873x-74qv). The confidentiality impact is arguably higher than C:L given that the exposed data is network topology from a dedicated security product, which could materially assist lateral movement planning in a Kubernetes environment. No EPSS score was provided in the available data. No KEV listing and no confirmed POC mean real-world exploitation risk is speculative, though the technical barrier is extremely low given the unauthenticated network vector. Organizations exposing the NeuVector manager API externally or to untrusted internal segments face meaningful reconnaissance risk. |
| Exploit ScenarioDerived | An attacker with network access to the NeuVector manager service port - either from an external network if the API is exposed, or from within the cluster - sends a simple unauthenticated HTTP GET request to /network/graph and receives cached JSON data describing the container network topology. This reconnaissance data reveals container names, namespace structures, service interconnections, and IP addressing, which the attacker uses to identify high-value targets for lateral movement within the Kubernetes cluster. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Unauthenticated access to NeuVector's manager /network/graph API exposes cached network topology data in all versions through 5.4.9, allowing any network-reachable attacker to retrieve sensitive container environment details without credentials. The missing authentication on this endpoint (CWE-202) means the container security platform itself becomes a reconnaissance source, potentially revealing Kubernetes service relationships, container names, and network flow data to adversaries. No public exploit code or active exploitation (KEV) has been identified at time of analysis, but the unauthenticated network vector significantly lowers the bar for exploitation.
RemediationAI
Consult the GitHub Security Advisory GHSA-hx45-873x-74qv at https://github.com/neuvector/manager/security/advisories/GHSA-hx45-873x-74qv for the patched release version and upgrade the NeuVector manager beyond 5.4.9 as the primary fix - the exact patched version is not independently confirmed from the data available and must be verified there. As an immediate compensating control, restrict network access to the NeuVector manager API using Kubernetes NetworkPolicy or external firewall rules to allow only authorized management hosts and SIEM/monitoring systems, which eliminates external unauthenticated reach without disabling the service; note this reduces exposure but does not fix the missing authentication. If the manager API is not required to be accessible from broad internal segments, placing it behind a VPN or zero-trust access gateway adds a meaningful authentication layer upstream. Do not treat network restriction as equivalent to patching, as internal attackers or compromised workloads would still be able to reach the endpoint.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NeuVector is a SUSE-maintained open-source container security platform that provides runtime protection, network visibility, and compliance enforcement for Kubernetes environments. Its manager component exposes a REST API and web UI for security operations. The /network/graph endpoint generates and caches network topology graphs depicting inter-container and inter-service communication flows - data that is inherently sensitive in a security product context. CWE-202 (Exposure of Sensitive Information Through Data Queries) identifies the root cause: the API endpoint lacks authentication middleware, so cached topology data - which may include container names, service endpoints, namespace mappings, and IP addressing - is returned to any client that issues a request. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms this is a direct network-accessible flaw with no preconditions or user interaction.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Network-accessible unauthenticated endpoint leaks security-sensitive topology data (C:H); no integrity or availability impact is described.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
DescriptionCVE.org
NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information.
Executive ViewAI
NeuVector container security platform versions through 5.4.9 expose an unauthenticated API endpoint (/network/graph) that reveals Kubernetes service topology, container deployment details, and network flow information to any network-connected attacker, transforming the security platform itself into a reconnaissance tool for adversaries. With no vendor-released patches available, organizations must implement compensating network controls to prevent the security infrastructure from leaking architectural intelligence to threat actors. This vulnerability directly undermines visibility and control objectives that the platform is intended to provide.
No vendor-released patch identified at time of analysis. Interim mitigations: Implement firewall rules or network policies restricting /network/graph endpoint access to authorized administrative networks only; deploy Web Application Firewall (WAF) to enforce authentication requirements on the endpoint; enable NeuVector API authentication if available in current configuration; monitor and alert on all unauthenticated access attempts; maintain network segmentation isolating NeuVector manager from production workloads; conduct periodic topology data reviews to identify and assess exposed infrastructure information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB