CVE-2025-67601: 
Rancher vulnerability analysis and mitigation

CVE-2025-67601 is an Improper Certificate Validation vulnerability in SUSE Rancher Manager's CLI that enables Man-in-the-Middle (MitM) attacks during the login command. When users invoke rancher login with the --skip-verify flag but without the --cacert flag, the CLI attempts to fetch CA certificates from Rancher's cacerts setting over an unverified connection, allowing a network-positioned attacker to inject a CA certificate they control. This vulnerability affects Rancher versions 2.10.0–2.10.10, 2.11.0–2.11.9, 2.12.0–2.12.5, and 2.13.0–2.13.1. The GitHub Advisory Database rates this as High severity with a CVSS v3.1 score of 8.3, while NVD records a base score of 4.8 (Medium) (GitHub Advisory, Rancher Advisory). The advisory was published on January 29, 2026, and added to the NVD on February 25, 2026.

The root cause is CWE-295 (Improper Certificate Validation): when the --cacert flag is omitted during rancher login --skip-verify, the CLI fetches CA certificates from the Rancher Manager's cacerts API endpoint without first establishing a trusted TLS session (GitHub Advisory). An attacker with network-level access (e.g., on the same network segment or via ARP/DNS poisoning) can intercept this initial unverified connection and return a rogue CA certificate, effectively completing a TLS interception despite the operator's intent to use --skip-verify only as a temporary bypass (Rancher Advisory). Because the subsequent authentication request is then made over the attacker-controlled TLS session, basic authentication headers (credentials) are exposed in plaintext to the attacker. The vulnerability is scoped exclusively to the login command and does not affect any other Rancher CLI commands.

A successful exploit allows an attacker to intercept and read basic authentication credentials (username and password) transmitted during the Rancher CLI login process, compromising confidentiality (GitHub Advisory). With captured Rancher Manager credentials, an attacker could gain unauthorized administrative access to the Rancher platform, potentially enabling full control over managed Kubernetes clusters, workloads, and secrets — representing significant lateral movement risk across the entire container infrastructure. The GitHub Advisory scores confidentiality, integrity, and availability impacts all as High with a scope change, reflecting the potential for compromise to extend beyond the CLI client to the broader Rancher-managed environment (Rancher Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.01% (1st percentile), indicating a very low near-term exploitation probability. Exploitation requires the attacker to have network-level access between the Rancher CLI client and the Rancher Manager server (high attack complexity), and a user must initiate a rancher login command with --skip-verify but without --cacert (user interaction required). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify environments where Rancher CLI users authenticate to Rancher Manager using self-signed certificates, particularly those using --skip-verify without --cacert (e.g., via internal documentation, configuration files, or CI/CD pipeline scripts).
2. Network Positioning: Gain network-level access between the Rancher CLI client and the Rancher Manager server — for example, via ARP spoofing, DNS poisoning, or a compromised network device on the same segment.
3. Intercept Initial Connection: When the victim runs rancher login --skip-verify https://rancher.example.com, intercept the CLI's unverified HTTP/TLS request to the Rancher cacerts API endpoint.
4. Inject Rogue CA: Return a self-controlled CA certificate in the response to the cacerts fetch, causing the Rancher CLI to trust the attacker's CA for the subsequent TLS session.
5. Capture Credentials: With the TLS session now terminating at the attacker's proxy, intercept the basic authentication headers (Base64-encoded username:password) sent during the login request.
6. Leverage Access: Use the captured credentials to authenticate directly to Rancher Manager and gain administrative control over managed Kubernetes clusters (GitHub Advisory, Rancher Advisory).

• Network: Unexpected ARP replies or DNS responses redirecting Rancher Manager hostnames to unknown IP addresses; TLS certificates presented by the Rancher Manager endpoint signed by an unrecognized or newly appeared CA.
• Logs: Rancher Manager access logs showing successful logins from IP addresses not associated with known CLI client hosts; authentication events at unusual times or from unexpected source IPs.
• Process/Behavior: Rancher CLI login commands executed with --skip-verify but without --cacert in shell history or CI/CD pipeline logs — these represent the vulnerable invocation pattern.
• Network: Outbound connections from Rancher CLI hosts to the Rancher Manager API (/v3/settings/cacerts) observed traversing unexpected network paths or intermediary hosts.

SUSE has released patched versions of Rancher: v2.10.11, v2.11.10, v2.12.6, and v2.13.2 — upgrading to one of these versions is the recommended remediation (Rancher Advisory). The fix removes the ability to fetch CA certificates from Rancher's cacerts setting during the login command; users must now explicitly provide CA certificates via the --cacert flag. For environments that cannot immediately upgrade, the workaround is to always pass --cacert <path-to-ca.pem> when invoking rancher login, even when also using --skip-verify. Additionally, implementing network segmentation and monitoring between CLI clients and Rancher Manager can reduce the risk of MitM positioning.

Security news outlet SecurityOnline.info covered the vulnerability under the headline "Silent Leak: High-Severity Rancher CLI Flaw Exposes Admin Credentials" (SecurityOnline). CyberPress also reported on the issue as a Rancher Manager security bug (CyberPress). Community discussion was noted on Mastodon and Bluesky, with security aggregators including Vulners and VulDB cataloging the advisory shortly after NVD publication.