NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive i…

CVE-2026-25703 affects NeuVector versions through 5.4.9, exposing a vulnerability in the manager /network/graph API endpoint. The flaw stems from missing authentication controls combined with cached data that may contain sensitive information. An unauthenticated attacker could potentially access sensitive network graph data without any credentials. The vulnerability was reported via SUSE Bugzilla and has a corresponding GitHub Security Advisory (GHSA-hx45-873x-74qv). NeuVector is a container security platform widely used in enterprise Kubernetes environments, making this exposure particularly significant. The lack of authentication on an API endpoint that returns cached sensitive data represents a serious information disclosure risk. Users are advised to update beyond version 5.4.9 once a patch is available.