CVE-2025-54468

Published: Oct 2, 2025Modified: Jun 17, 2026Deferred

4.7

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: meissner@suse.de (Secondary)

Description

A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54468

Source: meissner@suse.de

https://github.com/rancher/rancher/security/advisories/GHSA-mjcp-rj3c-36fr

Source: meissner@suse.de

Timeline

No history available yet.