CVE-2026-78427: Admission Control Bypass via Hardcoded Sidecar Image Exemption
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any user who is able to deploy workloads and control a container image path can exploit it. The user does not need to bypass the admission webhook directly; they can name an image path after one of the hardcoded service mesh sidecar images.
What is the practical impact on admission policies?
Admission deny rules can be evaded because matching containers are silently excluded from policy evaluation. This affects the availability of admission-policy enforcement rather than confidentiality or integrity directly.
Are all deployed containers affected by default?
No. The exemption applies when a container image path matches one of the three hardcoded service mesh sidecar image paths. Workloads whose image paths do not match those exemptions are not described as bypassing evaluation.