Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen.
Product
Rancher ist ein Werkzeug für die Verwaltung von Kubernetes-Container basierten Umgebungen.
Vulnerabilities 2
-
Medium 4.3
Rancher user retains access to clusters despite Global Role removal
A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters. This only affects custom Global Roles that have a * …
-
Medium 4.3
Rancher exposes sensitive information through audit logs
A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs.
Revision history
-
#3
Referenz(en) aufgenommen: EUVD-2025-35858
-
#2
CVSSv3.1 korrigiert
-
#1
Initiale Fassung
References
-
Rancher GitHub vom 2025-10-23
https://github.com/rancher/rancher/security/advisories/GHSA-j4vr-pcmw-hx59
-
Rancher GitHub vom 2025-10-23
https://github.com/rancher/rancher/security/advisories/GHSA-mw39-9qc2-f7mg