CVE-2025-23389
Fixed in a distro release EPSS <1%CVSS 8.4
A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.
Products: SUSE Rancher
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/rancher/rancher | 2.8.13 |
| Go | github.com/rancher/rancher | 2.9.7 |
| Go | github.com/rancher/rancher | 2.10.3 |
| Go | github.com/rancher/rancher | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | harvester | 1.8.1-r1 |
| Chainguard | harvester-fips | 1.8.1-r0 |
| Chainguard | harvester-fips-webhook | 1.8.1-r0 |
| Chainguard | harvester-webhook | 1.8.1-r1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250312T181707-1.1 |