CVE-2025-54468 Rancher sends sensitive information to external services through the `/meta/proxy` endpoint
Rancher Manager leaks sensitive user information, such as email addresses, to external services via the /meta/proxy endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-54468?
CVE-2025-54468 is a medium-severity vulnerability in SUSE rancher, published on 2 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.
Weakness: CWE-200
Which versions are affected by CVE-2025-54468?
9 open source packages ship an affected version, including github.com/rancher/rancher.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rancher/rancher Go | All versions | None |
github.com/rancher/rancher Go | From 2.10.0 | 2.10.10 |
github.com/rancher/rancher Go | From 2.10.0 | 2.10.10 |
github.com/rancher/rancher Go | From 2.11.0 | 2.11.6 |
github.com/rancher/rancher Go | From 2.11.0 | 2.11.6 |
github.com/rancher/rancher Go | From 2.12.0 | 2.12.2 |
3 more packages
github.com/rancher/rancher Go | From 2.12.0 | 2.12.2 |
github.com/rancher/rancher Go | From 2.9.0 | 2.9.12 |
github.com/rancher/rancher Go | From 2.9.0 | 2.9.12 |
How do I fix CVE-2025-54468?
Upgrade github.com/rancher/rancher to a fixed version for your release line: 2.10.10, 2.11.6, 2.12.2 or 2.9.12.
Is CVE-2025-54468 being exploited?
There is no known exploitation of CVE-2025-54468 in the wild and no public exploit code.
Sources
Also known as GHSA-mjcp-rj3c-36fr, GO-2025-3982.