{"id":"EUVD-2026-0816","enisaUuid":"b9da535a-5c3a-3ab9-a818-c1a5caada4e4","description":"Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password  if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster.  The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup.","datePublished":"Jan 8, 2026, 12:29:07 PM","dateUpdated":"Jan 8, 2026, 2:43:34 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2025-62877\nhttps://github.com/harvester/harvester/security/advisories/GHSA-6g8q-hp2j-gvwv\n","aliases":"CVE-2025-62877\nGHSA-6g8q-hp2j-gvwv\n","assigner":"suse","epss":0.51,"enisaIdProduct":[{"id":"1a60a56b-65a2-3519-81a8-5f04f9e40117","product":{"name":"harvester","vendor":{"name":"SUSE"}},"product_version":"1.6.0"},{"id":"b92302c4-fb0a-3877-94d5-d0a646afbfef","product":{"name":"harvester","vendor":{"name":"SUSE"}},"product_version":"1.5.0"}],"enisaIdVendor":[{"id":"62cd795e-24f7-3a38-80ee-b58be725e28e","vendor":{"name":"SUSE"}}],"enisaIdVulnerability":[{"id":"5ce2d3a6-f5bc-32c0-907b-8807b154e8f2","vulnerability":{"id":"CVE-2025-62877","description":"Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password  if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster.  The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup.","datePublished":"Jan 8, 2026, 12:29:07 PM","dateUpdated":"Jan 8, 2026, 2:43:34 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2025-62877\nhttps://github.com/harvester/harvester/security/advisories/GHSA-6g8q-hp2j-gvwv\n","enisa_id":"EUVD-2026-0816\n","assigner":"suse","epss":0.51,"dataProcessed":"Oct 27, 2026, 7:20:03 AM","vulnerabilityProduct":[{"id":"12f0a803-1ac6-31de-9fff-8a23a57c9234","product":{"name":"harvester","vendor":{"name":"SUSE"}},"product_version":"1.5.0"},{"id":"3a560c76-a70b-334b-a8e9-3af91074c2d8","product":{"name":"harvester","vendor":{"name":"SUSE"}},"product_version":"1.6.0"}],"vulnerabilityVendor":[{"id":"d7cc0296-07ea-3f84-bd39-7fe87255443d","vendor":{"name":"SUSE"}}]}},{"id":"e00332a4-a3e0-35f7-9d70-5c410120796a","vulnerability":{"id":"GHSA-6g8q-hp2j-gvwv","description":"Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer","datePublished":"Jan 5, 2026, 8:25:53 PM","dateUpdated":"Jan 8, 2026, 9:18:48 PM","baseScore":0.0,"references":"https://github.com/harvester/harvester/security/advisories/GHSA-6g8q-hp2j-gvwv\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-62877\nhttps://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2025-62877\nhttps://github.com/harvester/harvester\n","enisa_id":"EUVD-2026-0816\n","aliases":"GHSA-6g8q-hp2j-gvwv\nCVE-2025-62877\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:53:13 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}