Critical severity · published Jan 8, 2026
CVE-2025-62877
Harvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
harvester · SUSE
1.6.0; 1.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62877
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62877
bugzilla.suse.com
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-62877
github.com
https://github.com/harvester/harvester/security/advisories/GHSA-6g8q-hp2j-gvwv
More from harvester
8.6
CVE-2025-71261
Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS
3.8
CVE-2025-67860
NeuVector scanner insecurely handles passwords as command arguments