CVE-2026-78424CWE-78command-injection

CVE-2026-78424

High · published September 28, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
8.7
In the wild
Unconfirmed
What it is

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00196 · 8.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-28T16:17Z
References (1)
https://github.com/neuvector/neuvector/security/advisories/GHSA-vr77-8vmq-qfmj · [email protected]
EPSS history
Timeline
  • 30 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 28 SEP 11:44Z
    OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes
    cvelistv5