Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy (SUSE Rancher)
At a glance
- Source
- CVE.org
- State
- PUBLISHED
- Published
- Updated
- Assigner
- suse
Description
Missing filtering in the SUSEÂ Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,
Weaknesses (CWE)
- CWE-201 — Insertion of Sensitive Information Into Sent Data
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | suse |
European references
- ENISA EUVD · EUVD-2026-115330
- GCVE · GCVE-0-2026-88811
Affected products
| Product | Versions |
|---|---|
| SUSE · Rancher | affected 2.15.0 < 2.15.3 ; affected 2.14.0 < 2.14.7 ; affected 2.13.0 < 2.13.11 ; affected 2.12.0 < 2.12.15 ; affected 2.11.0 < 2.11.19 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |