PT-2026-1506 · Suse · Suse Virtualization

CVE-2025-62877

·

Published

2026-01-05

·

Updated

2026-07-30

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions SUSE Virtualization (Harvester) versions 1.5.x through 1.6.x
Description The interactive installer for SUSE Virtualization (Harvester) may expose the default OS SSH login password when creating a new cluster or adding hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is used with the Harvester configuration setup.
Recommendations Utilize the PXE boot mechanism along with the Harvester configuration setup to avoid this issue.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2025-62877
GHSA-6G8Q-HP2J-GVWV
GO-2026-4281
OPENSUSE-SU-2026:21483-1
SUSE-SU-2026:0142-1

Affected Products

Suse Virtualization