Admission Control Bypass via Hardcoded Sidecar Image Exemption
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.
CVE-2026-78427
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-78427
github.com/neuvector/neuvector
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "SUSE",
"product": "github.com/neuvector/neuvector",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "5.6.2",
"status": "unaffected"
},
{
"at": "5.5.4",
"status": "unaffected"
},
{
"at": "5.4.11",
"status": "unaffected"
}
],
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "v5.6.1"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-78427
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #3020 · Revision 1
- Added to Heist Feed
- Publisher date