CVE-2025-62877: 
vulnerability analysis and mitigation

CVE-2025-62877 is a critical default credential vulnerability in the SUSE Virtualization (Harvester) interactive installer, allowing unauthenticated remote attackers to gain SSH access to hyperconverged infrastructure hosts using the OS default administrative password. It affects the github.com/harvester/harvester-installer Go module in versions 1.5.0–1.5.2 and 1.6.0–1.6.1. The vulnerability was published on January 5, 2026, and added to the NVD on January 8, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-1188 (Initialization of a Resource with an Insecure Default): the SUSE Virtualization OS ships with a default administrative credential for the rancher user intended only for out-of-band management (e.g., serial console access). When the interactive installer is used to create or expand a cluster, it enables host networking — and thus SSH accessibility — before prompting the administrator to reset this default password. This creates a race-window during installation where any network-reachable attacker can authenticate via SSH using the known default credential without any privileges or user interaction required. The vulnerability does not affect deployments using the PXE boot mechanism with a Harvester configuration file, as that path allows pre-setting a secure password before network exposure (GitHub Advisory, Github Advisory).

Successful exploitation grants an unauthenticated remote attacker full administrative SSH access to the Harvester host during the installation window, resulting in complete compromise of confidentiality, integrity, and availability. An attacker with root-level access to a hyperconverged infrastructure node can access all hosted virtual machines and their data, modify or destroy cluster configuration, disrupt services, and potentially pivot laterally to other nodes in the cluster or integrated Rancher environments (GitHub Advisory).

1. Reconnaissance: Identify Harvester nodes undergoing interactive installation by scanning for open SSH (port 22) on network segments where SUSE Virtualization clusters are being deployed, using tools like nmap or masscan.
2. Timing the window: Monitor or wait for the installation phase where the interactive installer has enabled host networking (after the network configuration screen) but before the administrator has completed the password reset step.
3. Authenticate with default credentials: Attempt SSH login to the target host using the known default OS administrative credential for the rancher user (e.g., ssh rancher@<host-ip>) with the default password shipped with the SUSE Virtualization OS.
4. Achieve full system access: Upon successful authentication, the attacker obtains an interactive shell with administrative privileges on the Harvester node, enabling data exfiltration, VM access, cluster token retrieval, or lateral movement to other cluster nodes (GitHub Advisory).

• Network: Unexpected inbound SSH (TCP port 22) connections to Harvester hosts from untrusted or external IP addresses during or shortly after the installation window; SSH connections originating from IPs not belonging to known administrators.
• Logs: SSH authentication success events in /var/log/auth.log or journalctl -u sshd for the rancher user from unexpected source IPs during the installation phase; multiple rapid SSH login attempts followed by a successful login.
• Process: Unexpected interactive shell sessions (bash, sh) spawned under the rancher user account; unusual child processes (e.g., curl, wget, nc) initiated from an SSH session during installation.
• File System: New SSH authorized keys added to /home/rancher/.ssh/authorized_keys or /root/.ssh/authorized_keys by an unauthorized party; unexpected cron jobs, scripts, or binaries dropped on the host filesystem during the installation window (GitHub Advisory).

The vulnerability is fixed in SUSE Virtualization (Harvester) v1.7.0 and later, which updates the interactive installer to prompt for a password reset before enabling host networking and SSH access. Organizations running 1.5.x or 1.6.x should upgrade to v1.7.x as the primary remediation. If immediate upgrade is not possible, the following workarounds should be applied: (1) Switch to the PXE boot mechanism with a Harvester configuration file that pre-defines a secure password, bypassing the vulnerable interactive installer entirely; (2) Apply network security controls (e.g., firewall rules) to block external access to port 22 on installation hosts until the default password has been changed to a secure value (GitHub Advisory, Github Advisory).

The vulnerability received coverage from The Hacker Wire, which published an article titled "SUSE Harvester Installer Leaks Default SSH Passwords" shortly after disclosure (The Hacker Wire). The advisory was shared on social media platforms including Mastodon and Bluesky by security-focused accounts. Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT also published alerts referencing the vulnerability, indicating broad awareness within the European security community.