Rancher CLI skips TLS verification on Rancher CLI login command
Priority LOW 37CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295.
Summary
A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login command without also passing the –cacert flag results in the CLI attempting to fetch CA certificates stored in Rancher’s setting cacerts.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00167 5th percentileScored 2026-11-07
Fix Fixed rancher (SUSE): 0.0.0-20260129092249-bb0625fd1896, 2.13.2, 2.12.6 +2github.com/rancher/rancher (Go): 0.0.0-20260129092249-bb0625fd1896, 2.13.2, 2.12.6 +2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SUSE | rancher | before 0.0.0-20260129092249-bb0625fd1896; 2.13.0 to before 2.13.2; 2.12.0 to before 2.12.6; 2.11.0 to before 2.11.10; 2.10.0 to before 2.10.11 | 0.0.0-20260129092249-bb0625fd1896, 2.13.2, 2.12.6, 2.11.10, 2.10.11 | Patch available | CNA |
| — | github.com/rancher/rancher (Go) | before 0.0.0-20260129092249-bb0625fd1896 | 0.0.0-20260129092249-bb0625fd1896 | Patch available | GHSA-mc24-7m59-4q5p |
| — | github.com/rancher/rancher (Go) | 2.13.0 to before 2.13.2 | 2.13.2 | Patch available | GHSA-mc24-7m59-4q5p |
| — | github.com/rancher/rancher (Go) | 2.12.0 to before 2.12.6 | 2.12.6 | Patch available | GHSA-mc24-7m59-4q5p |
| — | github.com/rancher/rancher (Go) | 2.11.0 to before 2.11.10 | 2.11.10 | Patch available | GHSA-mc24-7m59-4q5p |
| — | github.com/rancher/rancher (Go) | 2.10.0 to before 2.10.11 | 2.10.11 | Patch available | GHSA-mc24-7m59-4q5p |
- rancher VendorSUSE Affected before 0.0.0-20260129092249-bb0625fd1896; 2.13.0 to before 2.13.2; 2.12.0 to before 2.12.6; 2.11.0 to before 2.11.10; 2.10.0 to before 2.10.11 Fixed in 0.0.0-20260129092249-bb0625fd1896, 2.13.2, 2.12.6, 2.11.10, 2.10.11 Patch available CNA
- github.com/rancher/rancher (Go) Vendor— Affected before 0.0.0-20260129092249-bb0625fd1896 Fixed in 0.0.0-20260129092249-bb0625fd1896 Patch available GHSA-mc24-7m59-4q5p
- github.com/rancher/rancher (Go) Vendor— Affected 2.13.0 to before 2.13.2 Fixed in 2.13.2 Patch available GHSA-mc24-7m59-4q5p
- github.com/rancher/rancher (Go) Vendor— Affected 2.12.0 to before 2.12.6 Fixed in 2.12.6 Patch available GHSA-mc24-7m59-4q5p
- github.com/rancher/rancher (Go) Vendor— Affected 2.11.0 to before 2.11.10 Fixed in 2.11.10 Patch available GHSA-mc24-7m59-4q5p
- github.com/rancher/rancher (Go) Vendor— Affected 2.10.0 to before 2.10.11 Fixed in 2.10.11 Patch available GHSA-mc24-7m59-4q5p
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* | 2.10.0 to before 2.10.11; 2.11.0 to before 2.11.10; 2.12.0 to before 2.12.6; 2.13.0 to before 2.13.2 | Vulnerable | SUSE |
- cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* Versions 2.10.0 to before 2.10.11; 2.11.0 to before 2.11.10; 2.12.0 to before 2.12.6; 2.13.0 to before 2.13.2 Vulnerable ·SUSE
Remediation
- Fix · CNA rancher (SUSE) Fixed in 0.0.0-20260129092249-bb0625fd1896, 2.13.2, 2.12.6, 2.11.10, 2.10.11
- Fix · GHSA-mc24-7m59-4q5p github.com/rancher/rancher (Go) Fixed in 0.0.0-20260129092249-bb0625fd1896 Advisory →
- Fix · GHSA-mc24-7m59-4q5p github.com/rancher/rancher (Go) Fixed in 2.13.2 Advisory →
- Fix · GHSA-mc24-7m59-4q5p github.com/rancher/rancher (Go) Fixed in 2.12.6 Advisory →
- Fix · GHSA-mc24-7m59-4q5p github.com/rancher/rancher (Go) Fixed in 2.11.10 Advisory →
- Fix · GHSA-mc24-7m59-4q5p github.com/rancher/rancher (Go) Fixed in 2.10.11 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-67601
- 2026-10-03 Alias added: GHSA-mc24-7m59-4q5p
References
Advisory 2
More SUSE Rancher vulnerabilities
- TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
- TI-2022-21489 Rancher: Non-random authentication token CVSS 3.1CRITICAL 9.8
- TI-2019-08380 An issue was discovered that affects the following versions of Rancher: v2.0.0 through… CVSS 3.0CRITICAL 9.8
- TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
- TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
- TI-2022-21491 Rancher: Exposure of sensitive fields CVSS 3.1CRITICAL 9.9
Sources
- CVE-2025-67601 · CVE Program
- CVE-2025-67601 · NVD
- FIRST EPSS
- GHSA-mc24-7m59-4q5p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences