Cloudanix VulnDB

CVE-2025-54471

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Oct 30, 2025

CISA due date

—

The record

NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations when NeuVector stores the data.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/neuvector/neuvector 0.0.0-20230727023453-1c4957d53911 0.0.0-20251020133207-084a437033b4
Go github.com/neuvector/neuvector 5.3.0 5.4.7
Chainguard neuvector-scanner 0 3.962-r0
Chainguard neuvector-scanner-fips 0 3.962-r0
Chainguard neuvector-scanner-monitor 0 3.962-r0
Chainguard neuvector-scanner-monitor-fips 0 3.962-r0
Chainguard neuvector-scanner-task 0 3.962-r0
Chainguard neuvector-scanner-task-fips 0 3.962-r0
Wolfi neuvector-scanner 0 3.962-r0
Wolfi neuvector-scanner-monitor 0 3.962-r0
Wolfi neuvector-scanner-task 0 3.962-r0
go github.com/neuvector/neuvector 5.3.0 5.4.7
openSUSE:Tumbleweed govulncheck-vulndb 0 0.0.20251105T184115-1.1

Related vulnerabilities