Read the docs
TI-2025-34265 Aliases CVE-2025-54468GHSA-mjcp-rj3c-36fr

Rancher sends sensitive information to external services through the `/meta/proxy` endpoint

Priority LOW 22CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00361 30th percentileScored 2026-11-07
Fix Fixed rancher (SUSE): 2.12.2, 2.11.6, 2.10.10 +1github.com/rancher/rancher (Go): 2.12.2, 2.11.6, 2.10.10 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSErancher2.12.0 to before 2.12.2; 2.11.0 to before 2.11.6; 2.10.0 to before 2.10.10; 2.9.0 to before 2.9.122.12.2, 2.11.6, 2.10.10, 2.9.12Patch availableCNA
—github.com/rancher/rancher (Go)2.12.0 to before 2.12.22.12.2Patch availableGHSA-mjcp-rj3c-36fr
—github.com/rancher/rancher (Go)2.11.0 to before 2.11.62.11.6Patch availableGHSA-mjcp-rj3c-36fr
—github.com/rancher/rancher (Go)2.10.0 to before 2.10.102.10.10Patch availableGHSA-mjcp-rj3c-36fr
—github.com/rancher/rancher (Go)2.9.0 to before 2.9.122.9.12Patch availableGHSA-mjcp-rj3c-36fr
  • rancher VendorSUSE Affected 2.12.0 to before 2.12.2; 2.11.0 to before 2.11.6; 2.10.0 to before 2.10.10; 2.9.0 to before 2.9.12 Fixed in 2.12.2, 2.11.6, 2.10.10, 2.9.12 Patch available CNA
  • github.com/rancher/rancher (Go) Vendor— Affected 2.12.0 to before 2.12.2 Fixed in 2.12.2 Patch available GHSA-mjcp-rj3c-36fr
  • github.com/rancher/rancher (Go) Vendor— Affected 2.11.0 to before 2.11.6 Fixed in 2.11.6 Patch available GHSA-mjcp-rj3c-36fr
  • github.com/rancher/rancher (Go) Vendor— Affected 2.10.0 to before 2.10.10 Fixed in 2.10.10 Patch available GHSA-mjcp-rj3c-36fr
  • github.com/rancher/rancher (Go) Vendor— Affected 2.9.0 to before 2.9.12 Fixed in 2.9.12 Patch available GHSA-mjcp-rj3c-36fr

Remediation

  • Fix · CNA rancher (SUSE) Fixed in 2.12.2, 2.11.6, 2.10.10, 2.9.12
  • Fix · GHSA-mjcp-rj3c-36fr github.com/rancher/rancher (Go) Fixed in 2.12.2 Advisory →
  • Fix · GHSA-mjcp-rj3c-36fr github.com/rancher/rancher (Go) Fixed in 2.11.6 Advisory →
  • Fix · GHSA-mjcp-rj3c-36fr github.com/rancher/rancher (Go) Fixed in 2.10.10 Advisory →
  • Fix · GHSA-mjcp-rj3c-36fr github.com/rancher/rancher (Go) Fixed in 2.9.12 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SUSE rancher 2.10.10, 2.11.6 and 2 more versions

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2024-38368 Rancher CLI SAML authentication is vulnerable to phishing attacksPriority LOW 36
    • TI-2024-38361 Rancher update on users can deny the service to the adminPriority LOW 34
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54468
  2. 2026-10-03 Alias added: GHSA-mjcp-rj3c-36fr

References

Advisory 1

Other 4

  • TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-03506 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04302 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04301 Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04298 Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
See all 1331 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences