CVE-2026-78427
Admission Control Bypass via Hardcoded Sidecar Image Exemption
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.
| CWE | CWE-807 |
| Vendor | go |
| Product | github.com/neuvector/neuvector |
| Published | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for go github.com/neuvector/neuvector
Be the first to know when new medium vulnerabilities affecting go github.com/neuvector/neuvector are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
go / github.com/neuvector/neuvector
0 ≤ v5.6.1