CVE-2026-78426 Overview
CVE-2026-78426 affects the JSON Web Token (JWT) verifier in NeuVector, the open-source container security platform. The verifier accepts noncanonical Base64URL encodings of the RSA signature field, treating semantically equivalent encodings as distinct tokens. An attacker holding a valid, unexpired JWT that has been logged out of NeuVector can continue authenticating by presenting the same signature with alternate Base64URL spellings. Session revocation fails until the token reaches its natural expiration. The issue is categorized under [CWE-863: Incorrect Authorization].
Critical Impact
Logout and session revocation controls fail to invalidate JWTs when the RSA signature field is re-encoded, allowing continued authenticated access until token expiry.
Affected Products
- NeuVector container security platform
- Deployments relying on NeuVector JWT-based session management
- SUSE-packaged NeuVector distributions
Discovery Timeline
- 2026-09-17 - CVE-2026-78426 published to the National Vulnerability Database
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-78426
Vulnerability Analysis
NeuVector maintains a server-side denylist of revoked JWTs, typically keyed by the token string or its signature. When a user logs out, the token identifier is added to this list. The verifier subsequently rejects any incoming request presenting that identifier.
The flaw lies in how the verifier canonicalizes the signature portion of the JWT before lookup. Base64URL permits multiple byte sequences that decode to the same underlying value when trailing bits are handled loosely. NeuVector compares the raw encoded string rather than the decoded signature bytes. An attacker who modifies non-significant characters in the signature produces a token that fails the denylist check but still passes cryptographic verification against the RSA public key.
The result is a broken authorization boundary: revoked tokens remain functionally valid. The attacker requires a previously issued token and user interaction is a factor in the CVSS scoring, which limits the exploitation surface.
Root Cause
The root cause is string-level comparison of Base64URL-encoded signatures instead of comparison against the canonical decoded byte representation. The verifier does not enforce a single canonical encoding for the signature field, violating the JWT specification's intent that revocation apply to the underlying cryptographic material rather than one particular textual form.
Attack Vector
Exploitation requires the attacker to already possess a valid JWT issued to a legitimate NeuVector user. After that user logs out, the attacker re-encodes the signature segment using an alternate but equivalent Base64URL representation and submits the reconstructed token. The NeuVector API accepts the modified token and grants access at the original user's privilege level until the token's exp claim elapses.
No verified proof-of-concept code is publicly available. See the GitHub Security Advisory GHSA-wcx5-mq6c-c54j for maintainer-provided technical detail.
Detection Methods for CVE-2026-78426
Indicators of Compromise
- Repeated authenticated NeuVector API requests from a user account after a logout event was recorded for that account.
- Multiple JWTs with identical header and payload segments but differing signature segments observed against the NeuVector control plane.
- API access from source IPs or user agents that differ from the session's original login context.
Detection Strategies
- Log every JWT presented to the NeuVector API and canonicalize the signature to detect duplicate underlying signatures with different Base64URL spellings.
- Correlate logout events with subsequent authenticated activity for the same subject claim within the token's remaining validity window.
- Alert when the same jti or subject claim is used from more than one client fingerprint concurrently.
Monitoring Recommendations
- Forward NeuVector controller and REST API logs to a centralized analytics platform for session-lifecycle correlation.
- Track JWT issuance, use, and revocation as discrete events keyed by canonical signature hash rather than raw token string.
- Monitor privileged NeuVector actions (policy edits, scan configuration changes, admission control updates) for post-logout activity.
How to Mitigate CVE-2026-78426
Immediate Actions Required
- Upgrade NeuVector to the fixed release referenced in GHSA-wcx5-mq6c-c54j.
- Reduce the JWT lifetime in NeuVector configuration to shorten the exposure window after logout.
- Rotate the RSA signing key used for NeuVector JWTs to invalidate all outstanding tokens.
Patch Information
Refer to the GitHub Security Advisory GHSA-wcx5-mq6c-c54j for the fixed version and upgrade guidance. SUSE customers should consult the SUSE Bug Report for CVE-2026-78426 for distribution-specific package updates.
Workarounds
- Restrict NeuVector controller access to trusted management networks to reduce the population of clients that could obtain a JWT.
- Enforce short token expiry values so revocation failure has a limited effective window.
- Require multi-factor authentication in front of NeuVector via an upstream identity proxy to raise the cost of credential reuse.
# Configuration example
# Reduce NeuVector JWT lifetime by setting a shorter session timeout
# via the NeuVector controller configuration API or Helm values file.
# Consult vendor documentation for the exact parameter in your release.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
