CVE-2025-8077 (CVSS 9.8): CRITICAL Flaw in NeuVector Exposes Kubernetes Clusters to Full Takeover

The SUSE Rancher Security Team has issued a critical advisory for NeuVector, noting CVE-2025-8077 (CVSS 9.8) exposes Kubernetes clusters to full compromise if not remediated.

NeuVector’s flaw stems from a weak, hardcoded credential in built-in admin accounts, where a fixed string is used as the default password for versions up to and including 5.4.5; if unchanged, any workload with network access within the cluster could use the default credentials to obtain an authentication token and invoke NeuVector APIs to gain administrative control.

Earlier mitigations allowed admins to set the bootstrap password via a Kubernetes Secret, but the advisory warns that if NeuVector fails to retrieve this value, it falls back to the fixed default password. The issue has been resolved in NeuVector version 5.4.6 and later, which introduces new Kubernetes RBAC permissions to ensure bootstrap passwords are managed through Secrets; these roles are automatically applied when deploying via Helm, and must be created beforehand if deploying or upgrading manually.

For those running vulnerable versions, the advisory urges immediate manual intervention, including logging in to the NeuVector UI and updating the default admin password. According to the advisory, if the required RBAC roles are not present, the NeuVector controller does not start.