This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Rancher fixes 2 high-severity vulnerabilities
Rancher fixes 2 high-severity vulnerabilities with versions 2.8.13, 2.9.7 and 2.10.3 [1][2].
Due to insufficient input validation in systems with a SAML authentication provider (AP) (e.g. Keycloak), an authenticated remote attacker can escalate their privileges. A newly created SAML AP user can impersonate any other user by manipulating cookies during the first login [1]. The vulnerability can also be exploited if a Rancher user was removed manually or automatically via the User Retention feature with delete-inactive-user-after [3]. Systems without SAML authentication and systems where all SAML users are already linked to accounts in Rancher are not vulnerable [1].
The vulnerability is present in product:
- *:Rancher;>=2.8.0,<2.8.13;>=2.9.0,<2.9.7;>=2.10.0,<2.10.3;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
More information:
- CVE-2025-23389 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 27. 2. 2025.
Due to a stack buffer overflow caused by uploading data to the public API endpoint /v3-public/authproviders, an unauthenticated remote attacker can perform a DoS attack on the Rancher server. Systems using both external authentication providers (AP) and local authentication are vulnerable. Downstream Kubernetes clusters managed by Rancher are not directly affected by this vulnerability [2].
The vulnerability is present in product:
- *:Rancher;>=2.8.0,<2.8.13;>=2.9.0,<2.9.7;>=2.10.0,<2.10.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
More information:
- CVE-2025-23388 at cve.org, NVD
- CWE-121: Stack-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 27. 2. 2025.
Links
By CESNET, z.s.p.o. Michaela Ručková on 4. 3. 2025.