Skip to content
CVE PROGRAM SOURCE RECORD8.3 High

CVE-2025-67601

Rancher CLI skips TLS verification on Rancher CLI login command

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login command without also passing the –cacert flag results in the CLI attempting to fetch CA certificates stored in Rancher’s setting cacerts.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE rancher

Default version status: unaffected

  • 0 to < 0.0.0-20260129092249-bb0625fd1896affected
  • 2.13.0 to < 2.13.2affected
  • 2.12.0 to < 2.12.6affected
  • 2.11.0 to < 2.11.10affected
  • 2.10.0 to < 2.10.11affected

References