CVE-2025-54468

MEDIUM

Rancher 2.9.0-2.12.1 Sensitive Information Exposure via Impersonate-Extra Headers

Title source: llm

Description

A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.

References (2)

Core 2

Core References

Issue Tracking

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54468

Vendor Advisory

https://github.com/rancher/rancher/security/advisories/GHSA-mjcp-rj3c-36fr

Scores

CVSS v3 4.7

EPSS 0.0001

EPSS Percentile 1.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (5)

rancher/rancher 2.12.0 - 2.12.2Go

SUSE/rancher 2.10.0 - 2.10.10

SUSE/rancher 2.11.0 - 2.11.6

SUSE/rancher 2.12.0 - 2.12.2

SUSE/rancher 2.9.0 - 2.9.12

Published Oct 02, 2025

Tracked Since Feb 18, 2026