EUVD-2026-88224Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low complexity, requires a low-privilege Runtime Policies write role (PR:L) or internal cert; full node compromise gives C/I/A:H; scored S:U per vendor though node escalation arguably justifies S:C.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
5DescriptionCVE.org
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions.
Articles & Coverage 1
AnalysisAI
OS command injection in SUSE NeuVector 5.4 (before 5.4.11), 5.5 (before 5.5.4), and 5.6 (before 5.6.2) allows an attacker who already satisfies one of two prerequisites - an authenticated NeuVector user holding the namespaced Runtime Policies (write) permission, or possession of NeuVector's internal gRPC certificate key pair - to inject operating-system commands that execute inside the privileged enforcer container, resulting in complete compromise of the underlying worker node. The flaw is rated 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning remote reachability, low attack complexity, authenticated low privileges, and no user interaction, with total confidentiality, integrity, and availability impact once the prerequisite is met. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ONE of two concrete prerequisites: (1) an authenticated NeuVector user holding the namespaced Runtime Policies (write) permission, or (2) possession of NeuVector's internal gRPC certificate key pair. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with total confidentiality/integrity/availability impact - consistent with OS command injection into a privileged container that yields worker-node compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available and should be applied as the primary fix: upgrade NeuVector 5.4.x to 5.4.11, 5.5.x to 5.5.4, and 5.6.x to 5.6.2 (or the latest build in each supported train), following the guidance in the vendor advisory at https://github.com/neuvector/neuvector/security/advisories/GHSA-vr77-8vmq-qfmj; because the flawed component is the privileged enforcer, the rollout must include the enforcer DaemonSet pods on every worker node, not just the controller, and a rolling restart is typically required for the new image to take effect. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SUSE NeuVector deployments and determine which instances run 5.4 (before 5.4.11), 5.5 (before 5.5.4), or 5.6 (before 5.6.2); audit and immediately reduce the set of users and service accounts holding the namespaced Runtime Policies (write) permission, and rotate the internal gRPC certificate key pair if any possibility of exposure exists. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today