{"cve":"CVE-2025-8077","nvd":{"published":"2025-09-17T13:15:34.460","modified":"2026-10-18T21:10:00.120","status":"Deferred","description":"A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-1393"],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-8077","https://github.com/neuvector/neuvector/security/advisories/GHSA-8pxw-9c75-6w56"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:10:08.713834912+00:00"},"epss":{"cve":"CVE-2025-8077","score":0.00558,"percentile":0.46208,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-8pxw-9c75-6w56","url":"https://osv.dev/vulnerability/GHSA-8pxw-9c75-6w56","summary":"NeuVector admin account has insecure default password","modified":"2026-09-10T03:50:57.949705210Z","packages":[{"ecosystem":"Go","name":"github.com/neuvector/neuvector","purl":"pkg:golang/github.com/neuvector/neuvector","ranges":["<0.0.0-20250825191744-da1a462074c3"],"fixed":["0.0.0-20250825191744-da1a462074c3"]}]},{"id":"GO-2025-3918","url":"https://osv.dev/vulnerability/GO-2025-3918","summary":"NeuVector admin account has insecure default password in github.com/neuvector/neuvector","modified":"2026-06-18T22:29:17.752924482Z","packages":[{"ecosystem":"Go","name":"github.com/neuvector/neuvector","purl":"pkg:golang/github.com/neuvector/neuvector","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}