CVE-2026-78424

HighCVSS 8.8/10Last modified Sep 29, 2026

Description

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 28, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-784257.6Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expe CVE-2026-784262.0The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that ha CVE-2026-784275.3The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded ser CVE-2026-784288.8For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authentica CVE-2026-784305.3A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/tools CVE-2026-784335.9Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissi CVE-2026-784346.5A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Contro CVE-2026-784353.8A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdes CVE-2026-784377.3Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from anoth CVE-2026-784387.2The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in CVE-2026-784398.8Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.CVE-2026-78446.3A vulnerability was detected in chatchat-space Langchain-Chatchat up to 0.3.1.3. This vulnerability affects the function files/list_files/re