CVE-2025-66001
High · 8.8CVSS
8.8
EPSS
0.4%
Published
Jan 8, 2026
CISA due date
—
The record
NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/neuvector/neuvector | 0 | No fix |
| Go | github.com/neuvector/neuvector | 5.3.0 | 5.4.8 |
| go | github.com/neuvector/neuvector | 5.3.0 | 5.4.8 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20251230T014957-150000.1.134.1 |
Related vulnerabilities
- CVE-2025-54471 NeuVector used a hard-coded cryptographic key embedded in the source code. Also affects github.com/neuvector/neuvector
- CVE-2025-54470 This vulnerability affects NeuVector deployments only when the Report anonymous cluster… Also affects github.com/neuvector/neuvector
- CVE-2025-54469 A vulnerability was identified in NeuVector, where the enforcer used environment… Also affects github.com/neuvector/neuvector
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34040 Moby is an open source container framework. Also affects govulncheck-vulndb