CVE-2023-32188 — neuvector
CVE-2023-32188 is a CWE-1270 vulnerability in github.com/neuvector/neuvector. A fix is available for github.com/neuvector/neuvector — see the affected versions and patch details below.
JWT token compromise can allow malicious actions including Remote Code Execution (RCE)
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2023-32188.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Real-World Exposure
github.com/neuvector/neuvectorReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Impact
A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.
Patches
Upgrade to NeuVector version 5.2.2 or later and latest Helm chart (2.6.3+).
- In 5.2.2 the certificate for JWT-signing is created automatically by controller with validity of 90days and rotated automatically.
- Use Helm-based deployment/upgrade to 5.2.2 to generate a unique certificate for Manager, REST API, ahd registry adapter. Helm based installation/upgrade is required in order to automatically generate certificates upon initial installation and each subsequent upgrade.
- See release notes for manual/yaml based deployment advice.
- 5.2.2 also implements additional protections against possible RCE for the feature of custom compliance scripts.
Workarounds
Users can replace the Manager & Controller certificate manually by following the instructions in documented here. However, upgrading to 5.2.2 and replacing Manager/REST API certificate is recommended to provide additional security enhancements to prevent possible attempted exploit and resulting RCE. See release notes for additional details.
Credits
Thank you to Dejan Zelic at Offensive Security for responsibly reporting this vulnerability.
For More Information
View the NeuVector Security Policy
General NeuVector documentation
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/neuvector/neuvector | all versions | 0.0.0-20231003121714-be746957ee7cgo get github.com/neuvector/neuvector@v0.0.0-20231003121714-be746957ee7c |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/neuvector/neuvector, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/neuvector/neuvector to 0.0.0-20231003121714-be746957ee7c or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-32188 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2023-32188 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2023-32188. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2023-32188 in your dependencies?
O3 Security finds CVE-2023-32188 across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.