CVE-2025-23389
Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login
A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.
Reserved 2025-01-15 | Published 2025-04-11 | Updated 2025-04-12 | Assigner suseCWE-284: Improper Access Control
bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23389
github.com/...ancher/security/advisories/GHSA-mq23-vvg7-xfm4
Support options
