CVE-2025-23387 json
Rancher's SAML-based login via CLI can be denied by unauthenticated users
published last yr. modified last mo. also GHSA-5qmp-9x47-92q8 , GO-2025-3489 , EUVD-2025-10799
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.
Patch / fix
- go github.com/rancher/rancher 2.8.13, 2.9.7, 2.10.3
- SUSE rancher 2.8.13, 2.9.7, 2.10.3
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20250312T181707-1.1
opensuse advisories openSUSE-SU-2025:14889-1
- github.com/rancher/rancher@2481630 commit
- github.com/rancher/rancher@bedd911 commit
- github.com/rancher/rancher@ceeedb1 commit
- github.com/rancher/rancher@dfa034d commit
- github.com/rancher/rancher#48616 pull request
- github.com/rancher/rancher#48998 pull request
- github.com/rancher/rancher#48999 pull request
- github.com/rancher/rancher#49000 pull request
- github.com/rancher/rancher/releases/tag/v2.10.3 release
- github.com/rancher/rancher/releases/tag/v2.8.13 release
Is CVE-2025-23387 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/rancher/rancher | >=2.8.0, <2.8.13 >=2.9.0, <2.9.7 >=2.10.0, <2.10.3 all versions |
2.8.13 2.9.7 2.10.3 |
Affected products
- SUSE rancher
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/rancher/rancher/pull/48616
web
-
github.com
/rancher/rancher/pull/48998
web
-
github.com
/rancher/rancher/pull/48999
web
-
github.com
/rancher/rancher/pull/49000
web
-
github.com
/rancher/rancher/commit/2481630c4a5a75d81eb69d10d7558ea833395a1e
web
-
github.com
/rancher/rancher/commit/bedd911b9b321436faa2d9e20a161f6ac396aa74
web
-
github.com
/rancher/rancher/commit/ceeedb1aa67c319f4873615f19c3f56a66f39706
web
-
github.com
/rancher/rancher/commit/dfa034d05a55b5e57990a1f700176dcd8e963dbc
web
-
bugzilla.suse.com
/show_bug.cgi?id=CVE-2025-23387
web
-
github.com
/rancher/rancher/security/advisories/GHSA-5qmp-9x47-92q8
web, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-23387
advisory
-
github.com
/rancher/rancher
package
-
github.com
/rancher/rancher/releases/tag/v2.10.3
web
-
github.com
/rancher/rancher/releases/tag/v2.8.13
web
-
github.com
/rancher/rancher/releases/tag/v2.9.7
web
Sources
- CVE List CVE-2025-23387
- GitHub Advisory GHSA-5qmp-9x47-92q8
- NVD CVE-2025-23387
- OSV GO-2025-3489
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.