CVE-2025-62877
Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup.
- CVSS 3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-25)
- CWE
- CWE-1188
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6g8q-hp2j-gvwv | Go | github.com/harvester/harvester-installer | >=1.6.0 <=1.6.1 | no fix published |
| GHSA-6g8q-hp2j-gvwv | Go | github.com/harvester/harvester-installer | >=1.5.0 <=1.5.2 | no fix published |
| GO-2026-4281 | Go | github.com/harvester/harvester-installer | >=1.5.0 | no fix published |
| GO-2026-4281 | Go | github.com/harvester/harvester-installer | >=1.6.0 | no fix published |