Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2025-54467: NeuVector may expose passwords in its event log
CVE-2025-54467 · published 1 year ago
Summary
NeuVector can write command-line passwords to its security event log when it stops a Java process that includes those passwords as arguments. This could let anyone with access to the log see sensitive credentials. To reduce the risk, avoid placing passwords on the command line and configure NeuVector to mask or omit such details from logs.
What to do
- Update github.com neuvector to version 5.4.6.
- Update github.com neuvector to version 0.0.0-20250825231653-65d7e746ce84.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | neuvector |
>= 5.0.0, < 5.4.6 < 0.0.0-20250825231653-65d7e746ce84 Fix: upgrade to 5.4.6
|
Original advisory text
NeuVector process with sensitive arguments lead to leakage
When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector security event log.
References
- https://github.com/advisories/GHSA-w54x-xfxg-4gxq
- https://nvd.nist.gov/vuln/detail/CVE-2025-54467 Vendor Advisory
- https://github.com/neuvector/neuvector/security/advisories/GHSA-w54x-xfxg-4gxq Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54467... Vendor Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54467 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-522Insufficiently Protected Credentials
CWE-549Missing Password Field Masking
Timeline
Published17 Sep 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta