Rancher exposes sensitive information through audit logs (SUSE rancher)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.29 % · percentile 22 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- suse
- NVD status
- Deferred
Description
A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs.
Weaknesses (CWE)
- CWE-532 — Insertion of Sensitive Information into Log File
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | suse |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · meissner@suse.de (Secondary) |
Advisories
- GHSA-mw39-9qc2-f7mg — Rancher exposes sensitive information through audit logs
- GO-2025-4074 — Rancher exposes sensitive information through audit logs in github.com/rancher/rancher
European references
- ENISA EUVD · EUVD-2025-35858
- GCVE · GCVE-0-2024-58269
Affected products
| Product | Versions |
|---|---|
| SUSE · rancher | affected 0 < 0.0.0-20251013203444-50dc516a19ea |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |