CVE-2025-23387

Description

A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.

Reserved 2025-01-15 | Published 2025-04-11 | Updated 2025-04-11 | Assigner suse

Problem types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Product status

Default status
unaffected

2.8.0 before 2.8.13
affected

2.9.0 before 2.9.7
affected

2.10.0 before 2.10.3
affected

References

bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23387

github.com/...ancher/security/advisories/GHSA-5qmp-9x47-92q8

cve.org (CVE-2025-23387)

nvd.nist.gov (CVE-2025-23387)

Download JSON