CVE-2025-62877

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-62877
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62877.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-62877
Aliases
Downstream
Related
Published
2026-01-08T12:29:07Z
Modified
2026-08-12T03:51:34Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Harvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer
Details

Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password  if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup.

Database specific 
{
    "cna_assigner": "suse",
    "cwe_ids": [
        "CWE-1188"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62877.json"
}
References

Affected packages

Git / github.com/harvester/harvester

Affected ranges

Type
GIT
Repo
https://github.com/harvester/harvester
Events
Introduced
b85b952b4936632595e57df082e37bd745d5ec57
Last Affected
0520ef1fab38c25f4e6bc5d526d1cb3084b8d897
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.6.0"
        },
        {
            "last_affected": "1.6.0"
        },
        {
            "introduced": "1.5.0"
        },
        {
            "last_affected": "1.5.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.5.0
1.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62877.json"