CVE-2025-66001 NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)
Attackers can intercept OpenID Connect authentication traffic due to disabled TLS verification, potentially leading to credential theft or session hijacking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-66001?
CVE-2025-66001 is a high-severity vulnerability in SUSE neuvector, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.
Weakness: CWE-295
Which versions are affected by CVE-2025-66001?
3 open source packages ship an affected version, including github.com/neuvector/neuvector.
| Package | Affected | Fixed in |
|---|---|---|
github.com/neuvector/neuvector Go | All versions | None |
github.com/neuvector/neuvector Go | From 5.3.0 | 5.4.8 |
github.com/neuvector/neuvector Go | From 5.3.0 | 5.4.8 |
How do I fix CVE-2025-66001?
Upgrade github.com/neuvector/neuvector to 5.4.8 or later.
Is CVE-2025-66001 being exploited?
There is no known exploitation of CVE-2025-66001 in the wild and no public exploit code.
Sources
Also known as GHSA-4jj9-cgqc-x9h5, GO-2025-4235.