CVE-2025-67860: 
vulnerability analysis and mitigation

CVE-2025-67860 is a credential exposure vulnerability in the NeuVector scanner where the scanner process accepts registry and controller credentials as command-line arguments, making them visible to local users via /proc/*/cmdline. It affects the github.com/neuvector/scanner Go module in versions >= 4.0 and < 4.072. The vulnerability was published on February 12, 2026, and assigned a CVSS v3.1 base score of 3.8 (Low) (Github Advisory).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials): the NeuVector scanner monitor process passes registry and NeuVector controller credentials directly as command-line arguments to the scanner process. On Linux systems, command-line arguments of running processes are exposed through /proc/*/cmdline, which is readable by local users with sufficient permissions. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, with a changed scope because the leaked credentials can affect external services (registries, NeuVector controller) beyond the vulnerable component itself (Github Advisory).

Exploitation allows a local user on the host to read registry and NeuVector controller credentials from the process argument list. The consequences include unauthorized access to container image registries (potentially enabling image manipulation or poisoning), unauthorized access to the NeuVector controller, information disclosure, and potential lateral movement within the environment. The actual severity of impact on confidentiality, integrity, and availability depends on the permissions associated with the leaked credentials on their respective services (Github Advisory).

1. Gain local access: Obtain a low-privileged local account on the host running the NeuVector scanner process (e.g., through a compromised container or existing user account).
2. Enumerate running processes: List processes on the host using ps aux or by iterating /proc/*/cmdline to identify the NeuVector scanner process.
3. Extract credentials: Read the command-line arguments of the scanner process via cat /proc/<PID>/cmdline | tr '\0' ' ' to extract registry usernames, passwords, and NeuVector controller credentials passed as arguments.
4. Leverage credentials: Use the extracted credentials to authenticate to the target container registry or NeuVector controller, enabling image manipulation, data exfiltration, or further lateral movement within the environment (Github Advisory).

• Logs: Unexpected authentication events to container registries or the NeuVector controller from unusual source IPs or accounts not associated with normal scanner operations.
• Process: Unusual access patterns to /proc/<PID>/cmdline for the NeuVector scanner process by non-root or non-NeuVector users; unexpected cat, strings, or scripted reads of /proc entries.
• Network: Unauthorized registry pulls or pushes; unexpected API calls to the NeuVector controller from hosts or accounts not normally performing such actions.

The vulnerability is fixed in NeuVector scanner version v4.072 and above. Starting from v4.072, the scanner monitor process no longer passes credentials as command-line arguments; instead, credentials are provided to the scanner process via environment variables, preventing exposure through /proc/*/cmdline. There is no workaround available — users are strongly recommended to upgrade to v4.072 or later as soon as possible. Additionally, organizations should review logs for potentially leaked credentials and rotate any credentials that may have been exposed (Github Advisory).

The advisory was published by the SUSE Rancher Security team and reviewed by GitHub on February 12, 2026. Coverage has been limited to vulnerability aggregator sites and a brief technical post noting the insecure credential handling pattern (Infinitsec Post). No significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability database entries.