CVE-2025-67601
Fixed in a distro release EPSS <1%CVSS 8.3
A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login command without also passing the –cacert flag results in the CLI attempting to fetch CA certificates stored in Rancher’s setting cacerts.
Products: SUSE Rancher
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/rancher/rancher | 0.0.0-20260129092249-bb0625fd1896 |
| Go | github.com/rancher/rancher | 2.13.2 |
| Go | github.com/rancher/rancher | 2.12.6 |
| Go | github.com/rancher/rancher | 2.11.10 |
| Go | github.com/rancher/rancher | 2.10.11 |
| Go | github.com/rancher/rancher | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | harvester | no fix |
| Chainguard | harvester-fips | no fix |
| Chainguard | harvester-fips-webhook | no fix |
| Chainguard | harvester-webhook | no fix |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260205T172317-150000.1.146.1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |