Skip to content
Heist/ feed
Back to feed
Medium

Admission Control Bypass via Hardcoded Sidecar Image Exemption

Type: advisorySources: OSV

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-78427
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 23:43 UTC · Revision 1

Source evidence

Admission Control Bypass via Hardcoded Sidecar Image Exemption

core-osv · Original source

Published 17 Sept 2026, 09:33 UTC

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.

osv:CVE-2026-78427
Complete source record
{
  "id": "a7d9a55d1a462afe96faf821236e3ba037571ce767702b5d426db4efda302133",
  "url": "https://osv.dev/vulnerability/CVE-2026-78427",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Admission Control Bypass via Hardcoded Sidecar Image Exemption",
    "summary": "The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.",
    "evidence": "osv:CVE-2026-78427",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-78427",
      "aliases": [
        "CVE-2026-78427",
        "GHSA-78r4-3wfq-r2xm"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/neuvector/neuvector",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "e457da1608de9231df7b82731e4d8cad9e910863"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "5.6.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "ChangesAt"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v5.6.2-rc4",
            "v5.6.2-rc3",
            "v5.6.2-rc2",
            "v5.6.1-rc4",
            "v5.6.1-rc3",
            "v5.6.1",
            "v5.6.0-rc4",
            "v5.6.0",
            "v5.6.0-rc3",
            "v5.6.0-rc1",
            "controller/k8sapi/v1.0.0",
            "v5.4.9",
            "v5.5.1-rc4",
            "v5.5.1-rc3",
            "v5.5.1-rc2",
            "v5.5.0-rc4",
            "v5.5.0-rc3",
            "v5.5.0",
            "v5.5.0-rc2",
            "v5.5.0-rc1",
            "v5.4.9-rc3",
            "v5.4.9-rc2",
            "v5.4.9-rc1",
            "v5.4.8",
            "v5.4.8-rc3",
            "v5.4.8-rc2",
            "v5.4.8-rc1",
            "v5.4.7-rc2",
            "v5.4.7-rc1",
            "v5.4.6-rc1",
            "v5.4.5-rc2",
            "v5.4.5",
            "v5.4.4-rc2",
            "v5.4.4",
            "v5.4.5-rc1",
            "v5.4.4-rc1",
            "v5.4.3-rc2",
            "v5.4.3-rc1",
            "v5.4.1-alpha",
            "v5.4.0-b3",
            "v5.4.0-b2-alpine",
            "v5.4.0-b2",
            "v5.4.0-b1-bci",
            "v5.4.0-b1",
            "voc415.1",
            "v5.3.3-b1",
            "v5.3.1-b1",
            "v5.3.0-b3",
            "v5.3.0-b2",
            "v5.3.0-b1",
            "v5.2.2-b2",
            "v5.2.2-b1",
            "v8040.1",
            "vlogvul.1",
            "v5.2.0-s1",
            "v5.2.0",
            "v5.2.0-b1",
            "vnsprune.1",
            "v5.1.1",
            "v5.1.1-b1",
            "v5.1.0-rc1",
            "vcilium.1",
            "veg.1",
            "v5.0.0-b2",
            "v5.0.0-b1",
            "v5.0.0-preview.3",
            "v5.0.0-preview.2",
            "v5.0.0-preview.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78427.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:40.545113996Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78427.json",
        "https://github.com/neuvector/neuvector/security/advisories/GHSA-78r4-3wfq-r2xm",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-78427",
        "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-78427"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-807"
        ],
        "cna_assigner": "suse",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78427.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-78427",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 508092,
  "published_at": "2026-09-17T09:33:26.318+00:00"
}