Skip to content
OpenAdvisories
High WID-SEC-2025-0457 3 CVEs

Rancher: Mehrere Schwachstellen

Published Feb 27, 2025 · Updated Mar 2, 2025 · Revision 2 · de-DE

Vendor: rancher Product: rancher

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Dateien zu manipulieren, administrative Rechte zu erlangen und einen Denial-of-Service-Zustand auszulösen.

Product

Rancher ist ein Werkzeug für die Verwaltung von Kubernetes-Container basierten Umgebungen.

Vulnerabilities 3

  • High 8.4
    CVE-2025-23389

    Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login

    A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.

    SUSE Rancher github.com/rancher/rancher Go
  • High 8.2
    CVE-2025-23388

    Unauthenticated stack overflow in /v3-public/authproviders API

    A Stack-based Buffer Overflow vulnerability in SUSE rancher allows for denial of service.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.

    SUSE Rancher github.com/rancher/rancher Go
  • Medium 5.3
    CVE-2025-23387

    Rancher's SAML-based login via CLI can be denied by unauthenticated users

    A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0…

    SUSE Rancher github.com/rancher/rancher Go

Revision history

  1. #2

    CVE's getauscht

  2. #1

    Initiale Fassung

References