Skip to content
OpenAdvisories
High WID-SEC-2025-2141 3 CVEs

Rancher: Mehrere Schwachstellen

Published Sep 25, 2025 · Updated Sep 28, 2025 · Revision 2 · de-DE

Vendor: rancher Product: rancher Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial of Service herbeizuführen und Informationen auszuspähen.

Product

Rancher ist ein Werkzeug für die Verwaltung von Kubernetes-Container basierten Umgebungen.

Vulnerabilities 3

  • High 8.0
    CVE-2024-58267

    Rancher CLI SAML authentication is vulnerable to phishing attacks

    A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phishing attacks. The custom authentication protocol for SAML-based providers can be abused to steal Rancher’s authentication…

    SUSE Rancher github.com/rancher/rancher Go
  • High 7.6
    CVE-2024-58260

    Rancher update on users can deny the service to the admin

    A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts.

    SUSE Rancher github.com/rancher/rancher Go
  • Medium 4.7
    CVE-2025-54468

    Rancher sends sensitive information to external services through the `/meta/proxy` endpoint

    A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive…

    SUSE Rancher github.com/rancher/rancher Go

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-31337, EUVD-2025-31335, EUVD-2025-31336

  2. #1

    Initiale Fassung

References