GO-2026-4393

Rancher CLI skips TLS verification on Rancher CLI login command in github.com/rancher/rancher

En bref

Publiée: 2026-02-02 21:05 UTC
Mise à jour: 2026-02-02 22:26 UTC
CVE: CVE-2025-67601
Alias: GHSA-mc24-7m59-4q5p

Description

Rancher CLI skips TLS verification on Rancher CLI login command in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/rancher/rancher before v0.0.0-20260129092249-bb0625fd1896, from v2.10.0 before v2.10.11, from v2.11.0 before v2.11.10, from v2.12.0 before v2.12.6, from v2.13.0 before v2.13.2.

Paquets affectés

Paquet	Versions
Go · github.com/rancher/rancher	introduced 0

Références

https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p ADVISORY
https://attack.mitre.org/techniques/T1557 WEB
https://github.com/rancher/rancher/releases/tag/v2.13.2 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database