Medium severity5.3GHSA Advisory· Published Sep 17, 2025· Updated Apr 15, 2026

CVE-2025-53884

Description

NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed).

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/neuvector/neuvectorGo	>= 5.0.0, < 5.4.6	5.4.6
github.com/neuvector/neuvectorGo	< 0.0.0-20250825191744-da1a462074c3	0.0.0-20250825191744-da1a462074c3

Affected products

Neuvector/NeuvectorGHSA
Range: < 0.0.0-20250825191744-da1a462074c3

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-8ff6-pc43-jwv3ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-53884ghsaADVISORY
bugzilla.suse.com/show_bug.cginvdWEB
github.com/neuvector/neuvector/security/advisories/GHSA-8ff6-pc43-jwv3nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000