Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-23387

Rancher's SAML-based login via CLI can be denied by unauthenticated users

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE rancher

Default version status: unaffected

  • 2.8.0 to < 2.8.13affected
  • 2.9.0 to < 2.9.7affected
  • 2.10.0 to < 2.10.3affected

References