CVE-2026-78428

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-78428
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78428.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-78428
Aliases
  • GHSA-c6rx-pmvf-m3jx
Published
2026-09-17T09:19:21Z
Modified
2026-10-21T02:59:54Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
Flaw in Neuvector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently
Details

For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

Database specific 
{
    "cna_assigner":  "suse",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78428.json"
}
References

Affected packages

Git / github.com/neuvector/neuvector

Affected ranges

Type
GIT
Repo
https://github.com/neuvector/neuvector
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c13b2f609e6c04276994439d60072caeb0dcf3d9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "5.6.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        }
    ]
}

Affected versions

controller/k8sapi/v1.*
controller/k8sapi/v1.0.0
v5.*
v5.0.0-b1
v5.0.0-b2
v5.0.0-preview.1
v5.0.0-preview.2
v5.0.0-preview.3
v5.1.0-rc1
v5.1.1
v5.1.1-b1
v5.2.0
v5.2.0-b1
v5.2.0-s1
v5.2.2-b1
v5.2.2-b2
v5.3.0-b1
v5.3.0-b2
v5.3.0-b3
v5.3.1-b1
v5.3.3-b1
v5.4.0-b1
v5.4.0-b1-bci
v5.4.0-b2
v5.4.0-b2-alpine
v5.4.0-b3
v5.4.1-alpha
v5.4.3-rc1
v5.4.3-rc2
v5.4.4
v5.4.4-rc1
v5.4.4-rc2
v5.4.5
v5.4.5-rc1
v5.4.5-rc2
v5.4.6-rc1
v5.4.7-rc1
v5.4.7-rc2
v5.4.8
v5.4.8-rc1
v5.4.8-rc2
v5.4.8-rc3
v5.4.9
v5.4.9-rc1
v5.4.9-rc2
v5.4.9-rc3
v5.5.0
v5.5.0-rc1
v5.5.0-rc2
v5.5.0-rc3
v5.5.0-rc4
v5.5.1-rc2
v5.5.1-rc3
v5.5.1-rc4
v5.6.0
v5.6.0-rc1
v5.6.0-rc3
v5.6.0-rc4
v8040.*
v8040.1
vcilium.*
vcilium.1
veg.*
veg.1
vlogvul.*
vlogvul.1
vnsprune.*
vnsprune.1
voc415.*
voc415.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78428.json"