NeuVector has an insecure password storage and is vulnerable to rainbow attack (CVE-2025-53884)

Why this deserves its current priority

CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps github.com/neuvector/neuvector (go), github.com/neuvector/neuvector (go). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
github.com/neuvector/neuvectorgo	<0.0.0-20250825191744-da1a462074c3	0.0.0-20250825191744-da1a462074c3
github.com/neuvector/neuvectorgo	>=0 <0.0.0-20250825191744-da1a462074c3	0.0.0-20250825191744-da1a462074c3

Recommended response

Check inventory. Check lockfiles and deployed manifests for github.com/neuvector/neuvector, github.com/neuvector/neuvector.
Review the reported fix. Update github.com/neuvector/neuvector to 0.0.0-20250825191744-da1a462074c3; github.com/neuvector/neuvector to 0.0.0-20250825191744-da1a462074c3 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Aug 28, 2025
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Jul 2, 2026

Sources and claim methodology

Upstream source description

### Impact NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed). NeuVector generates a cryptographically secure, random 16-character salt and uses it with the PBKDF2 algorithm to create the hash value for the following actions: - Creating a user - Updating a user’s password - Creating an API key **Note:** After upgrading to NeuVector 5.4.6, users must log in again so that NeuVector can regenerate the password hash. For API keys, you must send at least one request per API key to regenerate its hash value. ### Patches This issue is fixed in NeuVector version **5.4.6** and later. ### Workarounds There is no workaround. Upgrade to a patched version of NeuVector as soon as possible. ### References If you have any questions or comments about this advisory: - Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries. - Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository. - Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).

Quoted source text, attributed separately from HOL analysis.