NeuVector admission webhook bypass via sidecar image exclusion (v<5.6.2)
CVE-2026-78427 Published on September 17, 2026
Admission Control Bypass via Hardcoded Sidecar Image Exemption
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.
Vulnerability Analysis
CVE-2026-78427 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Reliance on Untrusted Inputs in a Security Decision
The application uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Products Associated with CVE-2026-78427
stack.watch emails you whenever new vulnerabilities are published in Suse Neuvector or Suse Github Com Neuvector Neuvector. Just hit a watch button to start following.
