---
id: CVE-2026-78427
title: >-
  The NeuVector admission webhook silently excludes containers from policy
  evaluation when their image path matches one of three hardcoded service mesh
  sidecar images
summary: >-
  The NeuVector admission webhook silently excludes containers from policy
  evaluation when their image path matches one of three hardcoded service mesh
  sidecar images. Since the image path is entirely controlled by the workload
  author, any…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-807
vendor: go
product: github.com/neuvector/neuvector
affected:
  - github.com/neuvector/neuvector <= v5.6.1
published: '2026-09-17'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T13:17:22.640'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78427'
references:
  - url: 'https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-78427'
    label: meissner@suse.de
  - url: >-
      https://github.com/neuvector/neuvector/security/advisories/GHSA-78r4-3wfq-r2xm
    label: meissner@suse.de
tags:
  - nvd
  - cve.org
epss: 0.00235
epssPercentile: 0.14301
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T12:10:23.202569Z'
cvssSource: nvd
ingestedAt: '2026-09-17T10:15:37.164Z'
---

## Overview

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.