CVE-2025-66001: 
Wolfi vulnerability analysis and mitigation

CVE-2025-66001 is an improper certificate validation vulnerability in NeuVector's OpenID Connect (OIDC) authentication that exposes the system to man-in-the-middle (MITM) attacks. TLS verification for OIDC connections is not enforced by default, meaning NeuVector does not verify the authenticity or integrity of the remote authentication server. The vulnerability affects NeuVector versions >= 5.3.0 and < 5.4.8 (Go module github.com/neuvector/neuvector). It was published on December 12, 2025, and assigned a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, NeuVector Advisory).

The root cause is classified as CWE-295 (Improper Certificate Validation): NeuVector's OIDC authentication flow does not validate the TLS certificate of the remote identity provider by default, allowing an attacker positioned on the network path to impersonate the OIDC server. While TLS verification support was introduced in version 5.4.0 for registry, auth server (SAML, LDAP, OIDC), and webhook connections, the feature defaulted to disabled — leaving all existing and new deployments prior to 5.4.8 unprotected unless manually configured. The fix, implemented in commit 955904b, sets EnableTLSVerification = true during new deployment initialization in controller/kv/create.go (NeuVector Advisory, Patch Commit). No public proof-of-concept exploit code has been identified.

Successful exploitation allows a network-positioned attacker to intercept and manipulate authentication communications between NeuVector and the OIDC identity provider, potentially leading to credential theft, session hijacking, and unauthorized access to the NeuVector management plane. Because NeuVector is a container security platform, unauthorized access could allow an attacker to alter security policies, disable enforcement, or gain visibility into the entire container workload environment. The CVSS score reflects high impacts to confidentiality, integrity, and availability (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (5th percentile), indicating a low near-term exploitation probability. Exploitation requires the attacker to be in a network position to intercept traffic between NeuVector and the OIDC provider, and also requires user interaction (a user must initiate an OIDC login) (GitHub Advisory).

1. Reconnaissance: Identify NeuVector deployments (versions 5.3.0–5.4.7) configured to use OpenID Connect for authentication, accessible via network scanning or service discovery within the target environment.
2. Network Positioning: Gain a man-in-the-middle position on the network path between the NeuVector controller and the OIDC identity provider — for example, via ARP spoofing, DNS poisoning, or a rogue network device on the same segment.
3. TLS Interception: Deploy a rogue TLS endpoint impersonating the legitimate OIDC provider. Because NeuVector does not validate the server's TLS certificate by default, it will accept the attacker's certificate without error.
4. Credential/Token Interception: When a user initiates an OIDC login to NeuVector, the authentication flow (including authorization codes, tokens, or credentials) is routed through the attacker's endpoint, allowing capture or manipulation of authentication data.
5. Unauthorized Access: Use intercepted tokens or credentials to authenticate to NeuVector as the victim user, gaining access to the management console and potentially altering container security policies or extracting sensitive configuration data (NeuVector Advisory).

• Network: Unexpected TLS handshakes to the OIDC provider endpoint originating from an unknown intermediate IP; anomalous DNS responses for the OIDC provider domain resolving to unexpected addresses; unusual ARP traffic on the network segment hosting the NeuVector controller.
• Logs: NeuVector authentication logs showing OIDC login events from unusual source IPs or at unusual times; TLS certificate details in connection logs that do not match the expected OIDC provider's certificate fingerprint or issuer.
• Authentication Events: Multiple failed or unexpected OIDC authentication attempts; logins from accounts that do not correspond to known users; session tokens issued outside of normal business hours or from unexpected geographic locations.
• Configuration: NeuVector system configuration showing TLS verification disabled (EnableTLSVerification = false) in deployments that should have been upgraded to 5.4.8 or later (NeuVector Advisory).

Upgrade NeuVector to version 5.4.8 or later, which enables TLS verification by default for new deployments (NeuVector Advisory). For rolling upgrades, TLS verification is not automatically enabled to prevent service disruption — administrators must manually enable it via the NeuVector UI: navigate to Settings > Configuration > TLS Self-Signed Certificate Configuration and select Enable TLS verification. Optionally, upload or paste the TLS self-signed certificate for the OIDC provider. Additionally, implement network segmentation to restrict access to the NeuVector controller and OIDC provider communication path, reducing MITM attack surface (GitHub Advisory).

The advisory was published by the SUSE Rancher Security team on December 12, 2025, and subsequently picked up by several vulnerability tracking services including ENISA EUVD, CIRCL, and GitLab Advisories. Coverage has been limited to automated vulnerability feeds and aggregators, with no notable independent researcher commentary or significant social media discussion identified beyond routine CVE broadcast posts (NeuVector Advisory).