CVE-2025-53884 NeuVector has an insecure password storage vulnerable to rainbow attack
Attackers can recover user passwords and API keys via rainbow table attacks due to unsalted hashing, compromising NeuVector accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53884?
CVE-2025-53884 is a medium-severity vulnerability in SUSE neuvector, published on 17 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed).
Weakness: CWE-759
Which versions are affected by CVE-2025-53884?
3 open source packages ship an affected version, including github.com/neuvector/neuvector.
| Package | Affected | Fixed in |
|---|---|---|
github.com/neuvector/neuvector Go | All versions | None |
github.com/neuvector/neuvector Go | All versions | 0.0.0-20250825191744-da1a462074c3 |
github.com/neuvector/neuvector Go | All versions | 0.0.0-20250825191744-da1a462074c3 |
How do I fix CVE-2025-53884?
Upgrade github.com/neuvector/neuvector to 0.0.0-20250825191744-da1a462074c3 or later.
Is CVE-2025-53884 being exploited?
There is no known exploitation of CVE-2025-53884 in the wild and no public exploit code.
Sources
Also known as GHSA-8ff6-pc43-jwv3, GO-2025-3917.