GHSA-x82x-2qj6-5rm2: Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy

Published Nov 2, 2026

Updated

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,

Event History

Nov 2, 2026

CVE Published

via OSV·04:48 PM

Data Sourced

via OSV·04:48 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Rancher Manager versions are affected?

Affected versions are SUSE Rancher 2.15.0 through 2.15.3, 2.14.0 through 2.14.7, and 2.13.0 through 2.13.11.

What does an attacker need to exploit this issue?

The provided vector indicates network-based exploitation with low attack complexity, no privileges, and no user interaction required. The issue involves missing filtering in the Rancher Manager meta proxy that can pass Rancher credentials to cloud providers.

What is the likely impact if exploitation succeeds?

Rancher credentials may be disclosed to third-party cloud-provider hosts. The supplied severity vector rates confidentiality and integrity impact as high, while availability impact is listed as none.

GHSA-x82x-2qj6-5rm2: Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy

Event History

Frequently Asked Questions

Which Rancher Manager versions are affected?

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which Rancher Manager versions are affected?

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?