NeuVector Manager Information Disclosure Vulnerability (CVE-2025-15723) Advisory

Vulnerability Overview A potential information disclosure vulnerability has been identified in the NeuVector Manager. This vulnerability allows unauthorized users to access sensitive information by retrieving cached or static data. The vulnerability exists within the Web Server API of the NeuVector Manager, specifically affecting the following API endpoints: Scope of Impact Affected Versions: , Fixed Version: Severity: High (CVSS v3 Score: 7.3 / 10) Remediation Patch Version: The vulnerability has been fixed in NeuVector 5.5.0 and later versions. Recommended Actions: - Upgrade to version 5.5.0 or higher. - After upgrading, users should rotate the GitHub tokens used in the configuration. Additional Information CVE ID: CVE-2025-15723 CVSS v3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Reference Links: - Access Token Manipulation: Make and Impersonate Token - NeuVector Repository - SUSE Rancher Security Team - NeuVector Support - Product Support Lifecycle Notes Static Data and Status Messages: These do not constitute a security threat as they do not expose or leak user data. Risk Report Logs: These contain system information but are only accessible after a user authenticates with a valid session token. Network Activity Graphs: If a user modifies cached data, it may lead to information disclosure in certain scenarios, but it will not result in the loss of user information. Temporary Solution Until the fixed version is available, it is recommended that users use a reverse proxy to cache authentication information returned from the backend and validate the token using this cached information before forwarding requests. References For any questions or comments, please contact the SUSE Rancher Security Team. Open an issue in the NeuVector repository for security-related inquiries. Contact the support team and review the product support lifecycle.

Goal Reached Thanks to every supporter — we hit 100%!

NeuVector Manager Information Disclosure Vulnerability (CVE-2025-15723) Advisory

More from this source