Rancher exposes sensitive information through audit logs (SUSE rancher)
En bref
- Source
- NVD
- EPSS
- EPSS 0.29 % · centile 22 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- suse
- Statut NVD
- Deferred
Description
A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs.
Faiblesses (CWE)
- CWE-532 — Informations sensibles insérées dans un fichier de journal
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | suse |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · meissner@suse.de (Secondary) |
Avis
- GHSA-mw39-9qc2-f7mg — Rancher exposes sensitive information through audit logs
- GO-2025-4074 — Rancher exposes sensitive information through audit logs in github.com/rancher/rancher
Références européennes
- ENISA EUVD · EUVD-2025-35858
- GCVE · GCVE-0-2024-58269
Produits affectés
| Produit | Versions |
|---|---|
| SUSE · rancher | affected 0 < 0.0.0-20251013203444-50dc516a19ea |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |