Skip to content
CVE PROGRAM SOURCE RECORD4.7 Medium

CVE-2025-54468

Rancher sends sensitive information to external services through the `/meta/proxy` endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE rancher

Default version status: unaffected

  • 2.12.0 to < 2.12.2affected
  • 2.11.0 to < 2.11.6affected
  • 2.10.0 to < 2.10.10affected
  • 2.9.0 to < 2.9.12affected

References