CVE-2026-78425 Overview
CVE-2026-78425 is an authentication bypass vulnerability in NeuVector's SAML Single Sign-On (SSO) implementation. NeuVector accepts SAML assertions issued by a corporate identity provider (IdP) without validating the assertion's intended audience. Any authenticated user of another application federated to the same IdP, such as a wiki, ticketing system, or expenses tool, can replay their assertion against NeuVector and obtain a session. The NotInAudience condition that would flag the mismatch is generated but never enforced. This weakness is classified under improper authentication [CWE-287].
Critical Impact
Any user with a valid account on any application behind the shared IdP can authenticate to NeuVector as themselves, gaining unauthorized access to container security controls and data.
Affected Products
- NeuVector container security platform
- SUSE-distributed NeuVector builds (see vendor advisory)
- Deployments using SAML SSO with a shared corporate IdP
Discovery Timeline
- 2026-09-17 - CVE-2026-78425 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-78425
Vulnerability Analysis
SAML assertions carry an <AudienceRestriction> element that binds an assertion to one or more service providers (SPs). A conforming SP must reject any assertion whose audience does not include its own entity identifier. NeuVector's SSO handler parses assertions and records a NotInAudience warning when the audience does not match, but the code path that consumes the warning does not block authentication. The assertion is treated as valid based on signature and subject alone.
The result is cross-application assertion replay. A user authenticates to any peer SP behind the same IdP, captures the assertion returned to that SP, and posts it to NeuVector's Assertion Consumer Service. NeuVector maps the subject to a local account and issues a session. Access is scoped to whatever role NeuVector assigns the mapped identity, which in many deployments includes administrative privilege for internal staff accounts.
Root Cause
The root cause is missing audience restriction enforcement during SAML response processing. The implementation surfaces the NotInAudience signal as a warning rather than a fatal validation error, violating the SAML 2.0 Core specification requirement that SPs reject assertions not intended for them.
Attack Vector
Exploitation requires the attacker to hold a legitimate account on any application federated to the same IdP as the target NeuVector instance. The attacker performs a normal SSO login to that peer application, intercepts the signed SAML response using browser developer tools or a proxy, and submits the assertion to the NeuVector SSO endpoint. Because the assertion signature is valid and NeuVector does not enforce audience, authentication succeeds. Refer to the GitHub Security Advisory GHSA-wgg5-24xq-px35 for protocol-level detail.
Detection Methods for CVE-2026-78425
Indicators of Compromise
- NeuVector SSO login events for user accounts that have no operational reason to access container security tooling.
- Successful NeuVector authentications originating from IP addresses or user agents that also transacted with unrelated internal SPs seconds earlier.
- IdP audit logs showing SAML responses issued for peer SPs whose subjects subsequently appear in NeuVector session logs.
Detection Strategies
- Correlate IdP-issued audience values against the destination SP by joining IdP logs with NeuVector authentication logs.
- Alert on any NeuVector login event where the consumed assertion carries an <Audience> value that does not match the NeuVector entity ID.
- Baseline expected NeuVector user populations and flag first-time logins from accounts outside the platform team.
Monitoring Recommendations
- Forward NeuVector controller logs and IdP SSO logs into a central analytics platform for cross-source correlation.
- Retain SAML response payloads or audience metadata long enough to investigate suspected replay across SPs.
- Review NeuVector role bindings weekly to reduce blast radius if unauthorized authentication occurs.
How to Mitigate CVE-2026-78425
Immediate Actions Required
- Upgrade NeuVector to a fixed release as listed in the GitHub Security Advisory GHSA-wgg5-24xq-px35.
- Restrict the NeuVector management interface to trusted networks and administrator workstations until patched.
- Audit NeuVector user accounts and remove any sessions or mappings that cannot be attributed to authorized administrators.
Patch Information
Refer to the GitHub Security Advisory GHSA-wgg5-24xq-px35 and the SUSE Bug Report CVE-2026-78425 for fixed version numbers and vendor-supplied packages.
Workarounds
- Configure the IdP to issue assertions for NeuVector using a dedicated audience that no other SP will accept, and disable SSO for NeuVector if that isolation cannot be enforced.
- Fall back to local authentication or a separate IdP tenant for NeuVector until the fixed release is deployed.
- Reduce default role assignments in NeuVector so that unexpectedly authenticated identities receive minimum privilege.
# Configuration example
# See vendor advisory for exact remediation steps; no verified configuration snippet is published.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
