CVE-2026-78426
LowCVSS 3.7Summary
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token validity expires.
Risk Assessment
An attacker can continue using a logged-out JWT, allowing unauthorized access to NeuVector resources until the token expires. This can lead to compromise of the container environment security.
Recommendation
Update NeuVector to a version that properly validates canonical Base64URL encoding of the RSA signature. Consider shortening JWT validity periods and implementing token revocation mechanisms.
Other vulnerabilities in NeuVector
See all- CVE-2026-78427Medium
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.
- CVE-2026-78425High
Authorised users of outside applications behind the same corporate identity provider (IdP), such as a wiki, ticketing system, or expenses tool, can log into their system via SAML SSO. If that assertion is presented to NeuVector, NeuVector accepts it because the only thing distinguishing an assertion for NeuVector from an assertion for the wiki is the element, and the NotInAudience warning that reports the mismatch is never read.
- CVE-2026-25703High
NeuVector through 5.4.9 can potentially leak information from the manager /network/graph API due to missing authentication and cached data containing sensitive information.
Original NVD description (English source)
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token validity expires.