Github Com Neuvector Neuvector
Monthly
SAML SSO authentication bypass in SUSE NeuVector lets anyone who legitimately holds an account on another application behind the same corporate identity provider log into NeuVector without ever having been granted a NeuVector account. NeuVector's SAML service provider handler never validates the assertion's <Audience> element, so a bearer assertion minted for a wiki, ticketing system, or expenses tool is accepted verbatim; the internal NotInAudience warning is produced but never read, which is the CWE-287 improper-authentication root cause. Exploitation is not free - it requires SAML authentication to be enabled against an IdP shared with at least one other relying party and valid credentials in that same federation (PR:L, AT:P) - but it needs no NeuVector account, no admin rights, and no victim interaction, and it yields high confidentiality and integrity impact; there is no public exploit identified at time of analysis and no CISA KEV entry, so this is a high-priority authentication defect rather than a confirmed actively exploited one.
NeuVector's Kubernetes admission webhook silently skips policy evaluation for containers whose image path matches one of three hardcoded service mesh sidecar images, so a user who can create workloads can evade configured admission deny rules by simply naming their image to match one of those sidecar paths. This is an authenticated bypass: per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), exploitation requires an actor with cluster RBAC permission to create pods or deployments (PR:L) plus a NeuVector deployment acting as an admission controller with deny rules actually enforced - if no deny rules exist there is nothing to bypass. Impact is limited to integrity of the admission control decision itself (I:L); the technique grants no code execution or data access on its own, and there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
SAML SSO authentication bypass in SUSE NeuVector lets anyone who legitimately holds an account on another application behind the same corporate identity provider log into NeuVector without ever having been granted a NeuVector account. NeuVector's SAML service provider handler never validates the assertion's <Audience> element, so a bearer assertion minted for a wiki, ticketing system, or expenses tool is accepted verbatim; the internal NotInAudience warning is produced but never read, which is the CWE-287 improper-authentication root cause. Exploitation is not free - it requires SAML authentication to be enabled against an IdP shared with at least one other relying party and valid credentials in that same federation (PR:L, AT:P) - but it needs no NeuVector account, no admin rights, and no victim interaction, and it yields high confidentiality and integrity impact; there is no public exploit identified at time of analysis and no CISA KEV entry, so this is a high-priority authentication defect rather than a confirmed actively exploited one.
NeuVector's Kubernetes admission webhook silently skips policy evaluation for containers whose image path matches one of three hardcoded service mesh sidecar images, so a user who can create workloads can evade configured admission deny rules by simply naming their image to match one of those sidecar paths. This is an authenticated bypass: per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), exploitation requires an actor with cluster RBAC permission to create pods or deployments (PR:L) plus a NeuVector deployment acting as an admission controller with deny rules actually enforced - if no deny rules exist there is nothing to bypass. Impact is limited to integrity of the admission control decision itself (I:L); the technique grants no code execution or data access on its own, and there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).