NeuVector admission webhook bypass via sidecar image exclusion (v<5.6.2)
CVE-2026-78427 Published on September 17, 2026
Admission Control Bypass via Hardcoded Sidecar Image Exemption
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.
Vulnerability Analysis
CVE-2026-78427 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.
Weakness Type
Reliance on Untrusted Inputs in a Security Decision
The application uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Products Associated with CVE-2026-78427
Want to know whenever a new CVE is published for Suse Neuvector? stack.watch will email you.
Affected Versions
go github.com/neuvector/neuvector:- Before and including v5.6.1 is affected.