CVE-2026-78428 Overview
CVE-2026-78428 is a session handling flaw affecting NeuVector deployments that use Single Sign-On (SSO) authentication through Security Assertion Markup Language (SAML) or OpenID Connect (OIDC). Concurrent SSO login attempts can cause the application to assign one user the authenticated session of another user. An attacker who times their login with a legitimate user's authentication flow may obtain that user's session context, including their roles and permissions. The issue was disclosed through GitHub Security Advisory GHSA-c6rx-pmvf-m3jx and tracked in SUSE Bug Report #1279937.
Critical Impact
Successful exploitation grants an attacker access to another authenticated user's session, potentially including administrative privileges within NeuVector.
Affected Products
- NeuVector container security platform (SSO-enabled deployments)
- Deployments configured with SAML authentication
- Deployments configured with OpenID Connect (OIDC) authentication
Discovery Timeline
- 2026-09-17 - CVE-2026-78428 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-78428
Vulnerability Analysis
The vulnerability is a race condition in the SSO authentication handler. When multiple SAML or OIDC login callbacks are processed concurrently, session state associated with one authentication response can be bound to a different user's request context. The result is a session mix-up in which the wrong identity is authenticated into an active session. Because both SAML and OIDC assertions may include group and role claims, the attacker inherits the victim's authorization scope inside NeuVector.
Root Cause
The defect lies in how the SSO callback path stores and retrieves in-flight authentication state. Shared session state is not correctly isolated per request, so a login completion for user A can be paired with the pending session container of user B. This is a concurrency and state-management flaw rather than a cryptographic or protocol weakness in SAML or OIDC themselves.
Attack Vector
Exploitation requires network access to the NeuVector login endpoint and the ability to initiate an SSO login attempt at the same time as a legitimate user. The attack complexity is high because timing must overlap with a genuine authentication flow, and user interaction is required from the victim to complete their SSO login. No prior authentication or credentials for the target user are needed. Successful exploitation crosses a trust boundary, replacing the attacker's identity with the victim's authenticated context.
No public proof-of-concept exploit code has been published. Refer to the NeuVector security advisory for authoritative technical detail.
Detection Methods for CVE-2026-78428
Indicators of Compromise
- Authentication audit records where the authenticated username in a session does not match the subject in the corresponding SAML assertion or OIDC ID token.
- Concurrent SSO callbacks from different source IP addresses resolving into overlapping session identifiers.
- User reports of logging into NeuVector and observing another user's dashboard, roles, or namespaces.
- Unexpected privilege elevation events immediately following an SSO login burst.
Detection Strategies
- Correlate identity provider (IdP) login events with NeuVector session establishment events and alert on subject mismatches.
- Baseline the normal rate of SSO callbacks and flag bursts of concurrent /auth or SSO callback requests.
- Review NeuVector audit logs for role or permission changes performed by users who did not initiate them.
Monitoring Recommendations
- Forward NeuVector authentication and audit logs to a centralized log platform for correlation with IdP logs.
- Alert on administrative actions performed within a short window after any concurrent SSO login activity.
- Monitor for session identifiers that switch associated user principals during their lifetime.
How to Mitigate CVE-2026-78428
Immediate Actions Required
- Upgrade NeuVector to the fixed release identified in GitHub Security Advisory GHSA-c6rx-pmvf-m3jx.
- Invalidate all active NeuVector sessions after upgrading and require users to re-authenticate.
- Review recent administrative actions in NeuVector for changes made under an unexpected identity.
Patch Information
Consult the vendor advisory at GHSA-c6rx-pmvf-m3jx and the corresponding SUSE Bug Report #1279937 for the fixed version numbers and package updates applicable to your distribution.
Workarounds
- Restrict access to the NeuVector web console to trusted networks to reduce the window for concurrent malicious logins.
- Temporarily disable SAML and OIDC SSO and require local authentication until the patch is applied.
- Enforce short session lifetimes and require re-authentication for privileged operations.
Refer to the vendor advisory for the authoritative configuration example accompanying the patched release.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.