Skip to content
CVE PROGRAM SOURCE RECORD8.4 High

CVE-2025-23389

Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE rancher

Default version status: unaffected

  • 2.8.0 to < 2.8.13affected
  • 2.9.0 to < 2.9.7affected
  • 2.10.0 to < 2.10.3affected

References