PT-2025-39666 · Suse · Rancher Manager

Samjustus · Published 2025-09-26 · Updated 2025-10-27 · CVE-2025-54468

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rancher Manager versions prior to 2.9.12 Rancher Manager versions prior to 2.10.10 Rancher Manager versions prior to 2.11.6 Rancher Manager versions prior to 2.12.2

Description A flaw exists in Rancher Manager that allows sensitive information, such as email addresses, to be sent in Impersonate-Extra-* headers to external entities when creating new cloud credentials. This occurs via the /meta/proxy API endpoint. The information is sent to whitelisted domains specified in nodedrivers.management.cattle.io objects, including domains like amazonaws.com and api.digitalocean.com. The headers involved include Impersonate-Extra-Username and Impersonate-Extra-Principalid. Passwords, password hashes, and Rancher authentication tokens are not leaked.

Recommendations Update Rancher Manager to version 2.9.12 or later. Update Rancher Manager to version 2.10.10 or later. Update Rancher Manager to version 2.11.6 or later. Update Rancher Manager to version 2.12.2 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-54468

GHSA-MJCP-RJ3C-36FR

GO-2025-3982

OPENSUSE-SU-2025:15666-1

SUSE-SU-2025:3799-1

Affected Products

Rancher Manager

References · 48

• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54468 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mjcp-rj3c-36fr · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3982 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54468 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15666-1 · Vendor Advisory
• https://github.com/rancher/rancher · Note
• https://github.com/rancher/rancher/security/advisories/GHSA-mjcp-rj3c-36fr · Note
• https://suse.com/security/cve/CVE-2025-55191 · Note
• https://suse.com/security/cve/CVE-2025-59347 · Note
• https://suse.com/security/cve/CVE-2025-59823 · Note
• https://twitter.com/VulmonFeeds/status/1973696340749152453 · Twitter Post
• https://suse.com/security/cve/CVE-2024-58267 · Note
• https://suse.com/security/cve/CVE-2025-59941 · Note
• https://suse.com/security/cve/CVE-2025-59824 · Note