Upstream information
Description
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.Upstream Security Advisories:
SUSE information
Overall state of this security issue: Does not affect SUSE products
This issue is currently rated as having moderate severity.
| CVSS detail | CNA (SUSE) |
|---|---|
| Base Score | 4.3 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | None |
| Integrity Impact | None |
| Availability Impact | Low |
| CVSSv3 Version | 3.1 |
SUSE Security Advisories:
- GHSA-78r4-3wfq-r2xm, published Wed Sep 16 11:06:03 CEST 2026
SUSE Timeline for this CVE
CVE page created: Wed Sep 16 13:08:50 2026CVE page last modified: Thu Sep 17 16:07:26 2026