CVE-2025-67601

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-67601", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2025-12-09T14:05:21.453Z", "datePublished": "2026-02-25T10:36:57.771Z", "dateUpdated": "2026-02-26T14:44:07.081Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "github.com/rancher/rancher", "product": "rancher", "vendor": "SUSE", "versions": [{"lessThan": "0.0.0-20260129092249-bb0625fd1896", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2.13.2", "status": "affected", "version": "2.13.0", "versionType": "semver"}, {"lessThan": "2.12.6", "status": "affected", "version": "2.12.0", "versionType": "semver"}, {"lessThan": "2.11.10", "status": "affected", "version": "2.11.0", "versionType": "semver"}, {"lessThan": "2.10.11", "status": "affected", "version": "2.10.0", "versionType": "semver"}]}], "datePublic": "2026-02-01T16:58:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the </span><code>-skip-verify</code><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;flag to the Rancher CLI login command without also passing the </span><code>\u2013cacert</code><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;flag results in the CLI attempting to fetch CA certificates stored in Rancher\u2019s setting cacerts. </span><br>"}], "value": "A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify\u00a0flag to the Rancher CLI login command without also passing the \u2013cacert\u00a0flag results in the CLI attempting to fetch CA certificates stored in Rancher\u2019s setting cacerts."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-02-25T10:36:57.771Z"}, "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-67601"}, {"url": "https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p"}], "source": {"discovery": "UNKNOWN"}, "title": "Rancher CLI skips TLS verification on Rancher CLI login command", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-67601", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T04:55:52.856025Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:07.081Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-67601", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T04:55:52.856025Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:04:30.404Z"}}], "cna": {"title": "Rancher CLI skips TLS verification on Rancher CLI login command", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SUSE", "product": "rancher", "versions": [{"status": "affected", "version": "0", "lessThan": "0.0.0-20260129092249-bb0625fd1896", "versionType": "semver"}, {"status": "affected", "version": "2.13.0", "lessThan": "2.13.2", "versionType": "semver"}, {"status": "affected", "version": "2.12.0", "lessThan": "2.12.6", "versionType": "semver"}, {"status": "affected", "version": "2.11.0", "lessThan": "2.11.10", "versionType": "semver"}, {"status": "affected", "version": "2.10.0", "lessThan": "2.10.11", "versionType": "semver"}], "packageName": "github.com/rancher/rancher", "defaultStatus": "unaffected"}], "datePublic": "2026-02-01T16:58:00.000Z", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-67601"}, {"url": "https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify\u00a0flag to the Rancher CLI login command without also passing the \u2013cacert\u00a0flag results in the CLI attempting to fetch CA certificates stored in Rancher\u2019s setting cacerts.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the </span><code>-skip-verify</code><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;flag to the Rancher CLI login command without also passing the </span><code>\u2013cacert</code><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;flag results in the CLI attempting to fetch CA certificates stored in Rancher\u2019s setting cacerts. </span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-02-25T10:36:57.771Z"}}}, "cveMetadata": {"cveId": "CVE-2025-67601", "state": "PUBLISHED", "dateUpdated": "2026-02-26T14:44:07.081Z", "dateReserved": "2025-12-09T14:05:21.453Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-02-25T10:36:57.771Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "github.com/rancher/rancher", "product": "rancher", "vendor": "SUSE", "versions": [{"lessThan": "0.0.0-20260129092249-bb0625fd1896", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2.13.2", "status": "affected", "version": "2.13.0", "versionType": "semver"}, {"lessThan": "2.12.6", "status": "affected", "version": "2.12.0", "versionType": "semver"}, {"lessThan": "2.11.10", "status": "affected", "version": "2.11.0", "versionType": "semver"}, {"lessThan": "2.10.11", "status": "affected", "version": "2.10.0", "versionType": "semver"}]}], "source": "meissner@suse.de"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*", "matchCriteriaId": "8434BB27-8099-4685-9FE5-C3E4FF565E79", "versionEndExcluding": "2.10.11", "versionStartIncluding": "2.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*", "matchCriteriaId": "4B7549C0-3315-469C-A43F-E8B7095E570D", "versionEndExcluding": "2.11.10", "versionStartIncluding": "2.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*", "matchCriteriaId": "81C70333-B5C6-4DAB-92B0-0FA49ED9CBE7", "versionEndExcluding": "2.12.6", "versionStartIncluding": "2.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*", "matchCriteriaId": "FDEACDC9-6A42-488C-AD8B-46E1B26CA943", "versionEndExcluding": "2.13.2", "versionStartIncluding": "2.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify\u00a0flag to the Rancher CLI login command without also passing the \u2013cacert\u00a0flag results in the CLI attempting to fetch CA certificates stored in Rancher\u2019s setting cacerts."}, {"lang": "es", "value": "Una vulnerabilidad ha sido identificada dentro de Rancher Manager, donde el uso de certificados CA autofirmados y pasar la bandera -skip-verify al comando de inicio de sesi\u00f3n de Rancher CLI sin pasar tambi\u00e9n la bandera \u2013cacert resulta en que la CLI intenta obtener certificados CA almacenados en la configuraci\u00f3n 'cacerts' de Rancher."}], "id": "CVE-2025-67601", "lastModified": "2026-06-17T09:57:54.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 6.0, "source": "meissner@suse.de", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67601", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T04:55:52.856025Z", "version": "2.0.3"}}]}, "published": "2026-02-25T11:16:02.643", "references": [{"source": "meissner@suse.de", "tags": ["Issue Tracking"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-67601"}, {"source": "meissner@suse.de", "tags": ["Vendor Advisory"], "url": "https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{}

{}