Description

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-28T12:17:40.897Z",
  "pubdate": "2026-09-28T12:17:40.897Z",
  "executiveSummary": "NeuVector is susceptible to an OS command injection vulnerability resulting from improper parameter handling within the system's management interface. This flaw allows unauthorized execution of arbitrary commands within the privileged enforcer container, which possesses high-level access to the underlying worker node.\nThe vulnerability affects NeuVector versions 5.4 prior to 5.4.11, 5.5 prior to 5.5.4, and 5.6 prior to 5.6.2. Attackers with specific namespaced permissions—specifically Runtime Policies (write)—or those who have obtained the internal gRPC certificate key pair can trigger this injection.\nSuccessful exploitation results in full command execution within the enforcer container, effectively facilitating a container breakout or complete compromise of the worker node where the enforcer is deployed. This represents a critical risk to container orchestration security, as it grants attackers administrative-level control over host resources, potentially leading to unauthorized data exfiltration, lateral movement within the cluster, or total host system takeover.\nThe vulnerability requires authenticated access or compromise of cryptographic material to execute, emphasizing the necessity of strict RBAC and secure handling of internal gRPC credentials.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient sanitization of input parameters processed by the NeuVector management components. When these inputs are passed to the backend, they are improperly handled, allowing an attacker to inject shell metacharacters or sequences that are subsequently interpreted and executed by the operating system shell within the enforcer container context.\nThe NeuVector enforcer container operates with high privileges to perform its security and network monitoring tasks. By injecting commands into this process, an attacker essentially escapes the intended application logic and achieves arbitrary code execution with the permissions granted to the container runtime environment.\nAttackers can leverage this flaw through two primary vectors. First, an authenticated user who has been granted the 'Runtime Policies (write)' permission within a specific namespace can manipulate API requests to include malicious payloads. Second, if an attacker gains unauthorized access to the internal gRPC certificate key pair, they can masquerade as a legitimate internal service to communicate with the enforcer and inject payloads via gRPC calls.\nThe attack flow follows a distinct pattern: 1) The attacker identifies or creates an input vector where parameter handling is vulnerable. 2) The attacker crafts a payload containing OS command sequences designed to bypass input filters. 3) The payload is submitted to the NeuVector interface or internal service. 4) The enforcer container processes the malicious input, fails to neutralize the shell control characters, and executes the payload. 5) The command executes within the privileged enforcer container, enabling post-exploitation activities such as spawning a reverse shell, escalating privileges on the host, or modifying host-level security configurations.\nThe impact is significant due to the privileged nature of the enforcer. Since the enforcer requires root-level or near-root-level access to the worker node for its operation (e.g., monitoring network traffic and process execution), the compromise of this container provides an attacker with a direct bridge to the underlying host kernel and file system, nullifying container-level isolation boundaries."
}