CVE-2025-62877: SUSE Harvester Information Disclosure

CVE-2025-62877 Overview

CVE-2025-62877 is a critical insecure default configuration vulnerability affecting SUSE Virtualization (Harvester) environments. Projects using the Harvester environment may expose the OS default SSH login password when utilizing the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. This exposure creates a significant security risk as attackers with network access could potentially authenticate to affected systems using default credentials.

The vulnerability does not affect environments that use the PXE boot mechanism along with the Harvester configuration setup, providing a safer alternative deployment method.

Critical Impact
Attackers with network access can potentially gain unauthorized SSH access to Harvester nodes using exposed default credentials, leading to complete system compromise with high confidentiality, integrity, and availability impact.

Affected Products

SUSE Virtualization (Harvester) 1.5.x (interactive installer deployments)
SUSE Virtualization (Harvester) 1.6.x (interactive installer deployments)

Discovery Timeline

2026-01-08 - CVE-2025-62877 published to NVD
2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-62877

Vulnerability Analysis

This vulnerability is classified under CWE-1188 (Initialization with Hard-Coded Network Resource Configuration Values). The core issue lies in how the interactive installer handles SSH authentication credentials during cluster creation and host addition processes. When administrators use the interactive installer in versions 1.5.x or 1.6.x, the system may fail to properly secure or randomize the default SSH password, leaving it in a predictable or exposed state.

The network-accessible nature of this vulnerability means that any attacker who can reach the SSH service on affected Harvester nodes could potentially authenticate without requiring any prior privileges or user interaction. This creates a complete compromise scenario where attackers can gain full control over affected virtualization infrastructure.

Root Cause

The root cause stems from insecure default configuration practices in the Harvester interactive installer. Specifically, the installer fails to enforce or properly handle the secure generation and configuration of SSH credentials during the initial setup process. This results in default SSH passwords being either predictable, shared across installations, or inadvertently exposed during the installation workflow.

The PXE boot mechanism with Harvester configuration setup avoids this issue because it follows a different credential initialization path that properly secures SSH authentication.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying Harvester nodes deployed using the affected interactive installer versions
Attempting SSH connections to these nodes using default or commonly known credentials
Upon successful authentication, gaining full system access to the virtualization host
Potentially pivoting to other nodes in the cluster or accessing hosted virtual machines

The exploitation is straightforward and does not require sophisticated techniques. Once an attacker gains SSH access to a Harvester node, they have complete control over that virtualization host, including access to virtual machines, network configurations, and cluster management capabilities.

Detection Methods for CVE-2025-62877

Indicators of Compromise

Unexpected SSH login attempts or successful authentications from unknown IP addresses
Multiple failed SSH authentication attempts followed by successful logins using default credentials
Unusual administrative activity on Harvester nodes from previously unseen source addresses
New user accounts or SSH keys added to the system without authorized change requests

Detection Strategies

Monitor SSH authentication logs for successful logins using default or commonly known usernames
Implement network traffic analysis to detect SSH brute-force attempts targeting Harvester nodes
Deploy host-based intrusion detection to alert on unauthorized system changes following SSH access
Use SentinelOne Singularity platform to detect and respond to suspicious authentication patterns and post-exploitation activities

Monitoring Recommendations

Enable comprehensive SSH logging with centralized log collection and analysis
Configure alerts for SSH logins from external or unexpected network ranges
Implement session recording for privileged access to Harvester infrastructure
Regularly audit SSH configurations and authorized keys across all Harvester nodes

How to Mitigate CVE-2025-62877

Immediate Actions Required

Immediately change all default SSH passwords on Harvester nodes deployed using the interactive installer
Audit all Harvester deployments to identify which nodes were created using the affected 1.5.x or 1.6.x interactive installer
Disable password-based SSH authentication and enforce SSH key-based authentication
Review SSH access logs for any signs of unauthorized access prior to remediation
Consider deploying new nodes using the PXE boot mechanism which is not affected by this vulnerability

Patch Information

Administrators should consult the official vendor advisories for patch availability and upgrade guidance. Security updates addressing this vulnerability can be tracked through the SUSE Bugzilla CVE-2025-62877 and the GitHub Security Advisory GHSA-6g8q-hp2j-gvwv.

Workarounds

Use the PXE boot mechanism with Harvester configuration setup instead of the interactive installer
Immediately reset all SSH credentials after deployment using the interactive installer
Implement network segmentation to restrict SSH access to management networks only
Deploy SSH jump hosts or bastion servers to control and audit all SSH access to Harvester infrastructure

bash

# Example: Disable password authentication and enforce SSH key-based auth
# Edit /etc/ssh/sshd_config on each Harvester node:

# Disable password authentication
PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no
UsePAM no

# Restart SSH service to apply changes
systemctl restart sshd