{"items":[{"id":"NVI-00017609","kind":"vulnerability","title":"NeuVector has an insecure password storage and is vulnerable to rainbow attack","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-8ff6-pc43-jwv3","CVE-2025-53884"],"plain_summary":"GitHub lists this reviewed advisory for github.com/neuvector/neuvector. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2daf9b2ad1ac28f293414d6467dcb6c1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-02T20:20:13.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-2daf9b2ad1ac28f293414d6467dcb6c1"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2daf9b2ad1ac28f293414d6467dcb6c1","url":"https://github.com/advisories/GHSA-8ff6-pc43-jwv3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-8ff6-pc43-jwv3","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T03:47:11.081Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2daf9b2ad1ac28f293414d6467dcb6c1"],"technology":"github.com/neuvector/neuvector","known_exclusions":[],"conditions_summary":"### Impact\n\nNeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed).\n\nNeuVector generates a cryptographically secure, random 16-character salt and uses it with the PBKDF2 algorithm to create the hash value for the following actions:\n\n- Creating a user\n- Updating a user’s password\n- Creating an API key\n\n**Note:** After upgrading to NeuVector 5.4.6, users must log in again so that NeuVector can regenerate the password hash. For API keys, you must send at least one request per API key to regenerate its hash value.\n\n### Patches\n\nThis issue is fixed in NeuVector version **5.4.6** and later.\n\n### Workarounds\n\nThere is no workaround. Upgrade to a patched version of NeuVector as soon as possible.\n\n### References\n\nIf you have any questions or comments about this advisory:\n\n- Reach out to the SUSE Rancher Security team for security related inquiries.\n- Open an issue in the NeuVector repository.\n- Verify with our [support matrix](https://www.suse.c","public_affected_ranges":["< 0.0.0-20250825191744-da1a462074c3"]}],"null_published_at":"2026-11-05T19:10:21.426Z","source_updated_at":"2026-07-02T20:20:13.000Z","source_disclosed_at":"2025-08-28T13:33:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T03:47:11.081Z"}],"next_cursor":null,"snapshot_revision":"42594"}