Critical NeuVector RCE Flaw (CVE-2025-54469, CVSS 10.0) Allows Command Injection via Unsanitized Environment Variables

A critical command-injection and buffer-overflow vulnerability in NeuVector, tracked as CVE-2025-54469 with a CVSS of 10.0, can be exploited via unsanitised environment variables. According to SUSE Rancher Security, the enforcer’s monitor process used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a shell command with popen, without validating or sanitising the values.

The flaw resides in the Enforcer container’s monitor, which manages internal subprocesses such as the Consul service, and can allow a malicious user with access to modify those variables to inject commands during the Enforcer’s startup. Exploitation could grant root-level code execution within the Enforcer container, enabling complete compromise of the containerised environment, potential lateral movement within a Kubernetes cluster, and privilege escalation if the container runs with elevated permissions.

SUSE has issued a fix in NeuVector version v5.4.7 and later, where the monitor now validates the environment variable values before executing shell commands.