CVE-2025-62879 Rancher Backup Operator pod's logs leak S3 tokens
Attackers with log access can steal S3 credentials from Rancher Backup Operator logs, compromising cloud storage security.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-62879?
CVE-2025-62879 is a medium-severity vulnerability in SUSE Rancher, published on 4 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-backup-operator pod's logs.
Weakness: CWE-532
Which versions are affected by CVE-2025-62879?
9 open source packages ship an affected version, including github.com/rancher/backup-restore-operator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rancher/backup-restore-operator Go | All versions | None |
github.com/rancher/backup-restore-operator Go | From 6.0.0 | 6.0.3 |
github.com/rancher/backup-restore-operator Go | From 6.0.0 | 6.0.3 |
github.com/rancher/backup-restore-operator Go | From 7.0.0 | 7.0.5 |
github.com/rancher/backup-restore-operator Go | From 7.0.0 | 7.0.5 |
github.com/rancher/backup-restore-operator Go | From 8.0.0 | 8.1.2 |
3 more packages
github.com/rancher/backup-restore-operator Go | From 8.0.0 | 8.1.2 |
github.com/rancher/backup-restore-operator Go | From 9.0.0 | 9.0.1 |
github.com/rancher/backup-restore-operator Go | From 9.0.0 | 9.0.1 |
Products include Suse Rancher Backup and Restore Operator.
How do I fix CVE-2025-62879?
Upgrade github.com/rancher/backup-restore-operator to a fixed version for your release line: 6.0.3, 7.0.5, 8.1.2 or 9.0.1.
Is CVE-2025-62879 being exploited?
There is no known exploitation of CVE-2025-62879 in the wild and no public exploit code.
Sources
Also known as GHSA-wj3p-5h3x-c74q, GO-2026-4591.