https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T12:34:16.207637+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-253959 EUVD-2026-253959 2026-10-04T12:34:16.275921+00:00 EUVD-2026-253959 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54468 fkie_cve-2025-54468 2026-10-04T12:34:16.275958+00:00

A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.

 https://cve.radiocsirt.org/vuln/ghsa-mjcp-rj3c-36fr GHSA-mjcp-rj3c-36fr — Rancher sends sensitive information to external services through the `/meta/proxy` endpoint 2026-10-04T12:34:16.275992+00:00

Affected: Go: github.com/rancher/rancher

### Impact

A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.

If the authentication provider is configured to have email or other sensitive and/or identifiable information as part of the username and principal ID then when a new cloud credential is being created in Rancher Manager this information is sent to an external entity such as `amazonaws.com`, in case of an AWS cloud credentials, in `Impersonate-Extra-Username` and/or `Impersonate-Extra-Principalid` headers. Please note that neither password, password hashes or Rancher’s related authentication tokens are leaked in those requests.

The entities to which such information is sent to are limited by the whitelisted domains specified in `nodedrivers.management.cattle.io` objects.

For example, the Amazon EC2 node driver contains the following whitelisted domains:

- `iam.amazonaws.com` - `iam.us-gov.amazonaws.com` - `iam.%.amazonaws.com.cn` - `iam.global.api.aws` - `ec2.%.amazonaws.com` - `ec2.%.amazonaws.com.cn` - `ec2.%.api.aws` - `eks.%.amazonaws.com` - `eks.%.amazonaws.com.cn` - `eks.%.api.aws` - `kms.%.amazonaws.com` - `kms.%.amazonaws.com.cn` - `kms.%.api.aws`

While the DigitalOcean driver contains the following whitelisted domain:

- `api.digitalocean.com`

### Patches

Thi…

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15666-1 openSUSE-SU-2025:15666-1 — govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media 2026-10-04T12:34:16.276047+00:00

govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2141 WID-SEC-W-2025-2141 — Rancher: Mehrere Schwachstellen 2026-10-04T12:34:16.276074+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial of Service herbeizuführen und Informationen auszuspähen.