High severity · published Jan 8, 2026
CVE-2025-66001
NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
neuvector · SUSE
5.3.0 before 5.4.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66001
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66001
bugzilla.suse.com
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-66001
github.com
https://github.com/neuvector/neuvector/security/advisories/GHSA-4jj9-cgqc-x9h5
More from neuvector
9.9
CVE-2025-54469
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow
9.8
CVE-2025-8077
NeuVector admin account has insecure default password
8.8
CVE-2026-78424
OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes
8.8
CVE-2026-78428
Flaw in Neuvector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently
8.6
CVE-2025-54470
NeuVector telemetry sender is vulnerable to MITM and DoS