High severity · published Sep 28, 2026
CVE-2026-78424
OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
NeuVector · SUSE
before 5.4.11; 5.5.0 before 5.5.4; 5.6.0 before 5.6.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78424
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78424
vendor-advisory
https://github.com/neuvector/neuvector/security/advisories/GHSA-vr77-8vmq-qfmj
More from NeuVector
8.8
CVE-2026-78428
Flaw in Neuvector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently
7.3
CVE-2026-25703
Potential information leakage from manager /network/graph API in NeuVector
6.8
CVE-2025-46808
Sensitive information is leaked into NeuVector’s manager container logs
2.0
CVE-2026-78426
Logout bypass via alternate JWT spelling