Rancher Backup Operator pod's logs leak S3 tokens
Priority LOW 30CWE-532Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-backup-operator pod's logs.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00375 31st percentileScored 2026-11-07
Fix Fixed Rancher (SUSE): 9.0.1, 8.1.2, 7.0.5 +1github.com/rancher/backup-restore-operator (Go): 9.0.1, 8.1.2, 7.0.5 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SUSE | Rancher | 9.0.0 to before 9.0.1; 8.0.0 to before 8.1.2; 7.0.0 to before 7.0.5; 6.0.0 to before 6.0.3 | 9.0.1, 8.1.2, 7.0.5, 6.0.3 | Patch available | CNA |
| — | github.com/rancher/backup-restore-operator (Go) | 9.0.0 to before 9.0.1 | 9.0.1 | Patch available | GHSA-wj3p-5h3x-c74q |
| — | github.com/rancher/backup-restore-operator (Go) | 8.0.0 to before 8.1.2 | 8.1.2 | Patch available | GHSA-wj3p-5h3x-c74q |
| — | github.com/rancher/backup-restore-operator (Go) | 7.0.0 to before 7.0.5 | 7.0.5 | Patch available | GHSA-wj3p-5h3x-c74q |
| — | github.com/rancher/backup-restore-operator (Go) | 6.0.0 to before 6.0.3 | 6.0.3 | Patch available | GHSA-wj3p-5h3x-c74q |
- Rancher VendorSUSE Affected 9.0.0 to before 9.0.1; 8.0.0 to before 8.1.2; 7.0.0 to before 7.0.5; 6.0.0 to before 6.0.3 Fixed in 9.0.1, 8.1.2, 7.0.5, 6.0.3 Patch available CNA
- github.com/rancher/backup-restore-operator (Go) Vendor— Affected 9.0.0 to before 9.0.1 Fixed in 9.0.1 Patch available GHSA-wj3p-5h3x-c74q
- github.com/rancher/backup-restore-operator (Go) Vendor— Affected 8.0.0 to before 8.1.2 Fixed in 8.1.2 Patch available GHSA-wj3p-5h3x-c74q
- github.com/rancher/backup-restore-operator (Go) Vendor— Affected 7.0.0 to before 7.0.5 Fixed in 7.0.5 Patch available GHSA-wj3p-5h3x-c74q
- github.com/rancher/backup-restore-operator (Go) Vendor— Affected 6.0.0 to before 6.0.3 Fixed in 6.0.3 Patch available GHSA-wj3p-5h3x-c74q
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:suse:rancher_backup_and_restore_operator:*:*:*:*:*:*:*:* | 6.0.0 to before 6.0.3; 7.0.0 to before 7.0.5; 8.0.0 to before 8.1.2; 9.0.0 to before 9.0.1 | Vulnerable | SUSE |
- cpe:2.3:a:suse:rancher_backup_and_restore_operator:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.0.3; 7.0.0 to before 7.0.5; 8.0.0 to before 8.1.2; 9.0.0 to before 9.0.1 Vulnerable ·SUSE
Remediation
- Fix · CNA Rancher (SUSE) Fixed in 9.0.1, 8.1.2, 7.0.5, 6.0.3
- Fix · GHSA-wj3p-5h3x-c74q github.com/rancher/backup-restore-operator (Go) Fixed in 9.0.1 Advisory →
- Fix · GHSA-wj3p-5h3x-c74q github.com/rancher/backup-restore-operator (Go) Fixed in 8.1.2 Advisory →
- Fix · GHSA-wj3p-5h3x-c74q github.com/rancher/backup-restore-operator (Go) Fixed in 7.0.5 Advisory →
- Fix · GHSA-wj3p-5h3x-c74q github.com/rancher/backup-restore-operator (Go) Fixed in 6.0.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-62879
- 2026-10-03 Alias added: GHSA-wj3p-5h3x-c74q
References
Advisory 3
Sources
- CVE-2025-62879 · CVE Program
- CVE-2025-62879 · NVD
- FIRST EPSS
- GHSA-wj3p-5h3x-c74q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences