PT-2026-22925 · Suse · Rancher Backup Operator
Publicado
2026-03-03
·
Atualizado
2026-03-25
·
CVE-2025-62879
CVSS v3.1
6.8
Média
| Vetor | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Rancher Backup Operator versions prior to 108.0.1+up9.0.1
Rancher Backup Operator versions prior to 107.1.2+up8.1.2
Rancher Backup Operator versions prior to 106.0.6+up7.0.5
Rancher Backup Operator versions prior to 105.0.6+up6.0.3
Description
A flaw exists in the Rancher Backup Operator that can lead to the exposure of S3 tokens, specifically the
accessKey and secretKey, within the logs of the rancher-backup-operator pod. The accessKey is exposed by default. The secretKey is exposed when the logging level is set to trace: true or debug: true. This leakage could allow unauthorized access to S3 resources.Recommendations
Versions prior to 108.0.1+up9.0.1 should be updated to a patched version.
Versions prior to 107.1.2+up8.1.2 should be updated to a patched version.
Versions prior to 106.0.6+up7.0.5 should be updated to a patched version.
Versions prior to 105.0.6+up6.0.3 should be updated to a patched version.
If updating is not possible, ensure that both debug and trace values are set to false to prevent potential leaks.
Rotate S3
accessKey and secretKey after upgrading to a fixed version, especially if logs are exported.Correção
Insertion into Log File
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Rancher Backup Operator