CVE-2025-62877

CRITICAL9.8

Harvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer

Published Jan 8, 2026

Modified 1 weeks ago

Details

Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup.

References

WEBhttps://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-62877 WEBhttps://github.com/harvester/harvester/security/advisories/GHSA-6g8q-hp2j-gvwv ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-62877

CVSS Analysis

CVSS v3.1

9.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

Other

CWE-1188

Ecosystems

Timeline

PublishedJan 8, 2026

ModifiedJan 8, 2026