CVE-2025-54468
Fixed in a distro release EPSS <1%CVSS 4.7
A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.
Products: SUSE Rancher
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/rancher/rancher | 2.12.2 |
| Go | github.com/rancher/rancher | 2.11.6 |
| Go | github.com/rancher/rancher | 2.10.10 |
| Go | github.com/rancher/rancher | 2.9.12 |
| Go | github.com/rancher/rancher | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | harvester | 1.8.1-r1 |
| Chainguard | harvester-fips | 1.8.1-r0 |
| Chainguard | harvester-fips-webhook | 1.8.1-r0 |
| Chainguard | harvester-webhook | 1.8.1-r1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20251023T162509-150000.1.110.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0.0.20251023T162509-150000.1.110.1 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0.0.20251023T162509-1.1 |