CVE-2025-53884

5.3 mediumEPSS 0.2%

Medium (5.3). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/neuvector/neuvector 0.0.0-20250825191744-da1a462074c3.

NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed).

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 6% of CVEs (scores of 2026-10-31)
CWE: CWE-759
Published: 2025-09-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-8ff6-pc43-jwv3	Go	github.com/neuvector/neuvector	<0.0.0-20250825191744-da1a462074c3	0.0.0-20250825191744-da1a462074c3
GO-2025-3917	Go	github.com/neuvector/neuvector	all versions	no fix published

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53884
https://github.com/neuvector/neuvector/security/advisories/GHSA-8ff6-pc43-jwv3

Check your stack JSON