CVE-2026-78427
Admission Control Bypass via Hardcoded Sidecar Image Exemption
CVSS Score
0.0
EPSS Score
0.4%
EPSS Percentile
29th
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.
| CWE | CWE-807 |
| Vendor | suse |
| Product | github.com/neuvector/neuvector |
| Published | Sep 17, 2026 |
| Last Updated | Sep 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for suse github.com/neuvector/neuvector
Be the first to know when new unknown vulnerabilities affecting suse github.com/neuvector/neuvector are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
SUSE / github.com/neuvector/neuvector
0 ≤ v5.6.1