https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 20:47:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274208 EUVD-2026-274208 https://cve.radiocsirt.org/vuln/euvd-2026-274208 https://cve.radiocsirt.org/vuln/fkie_cve-2025-62879 <p>A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-backup-operator pod&#39;s logs.</p> <p>A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-backup-operator pod&#39;s logs.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-62879 https://cve.radiocsirt.org/vuln/ghsa-wj3p-5h3x-c74q <p><strong>Affected:</strong> Go: github.com/rancher/backup-restore-operator</p> <p>### Impact A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both `accessKey` and `secretKey`) into the rancher-backup-operator pod&#39;s logs.</p> <p>Specifically, the S3 `accessKey` and `secretKey` are exposed in the pod&#39;s logs under the following logging level conditions:</p> <p>| Variable Exposed | Logging Level Condition | ------------------ | ------------------------- | | accessKey | `trace: false` (default), and `debug: false` (default) | | secretKey | `trace: true` or `debug: true`|</p> <p>**Note:** The S3 `accessKey` is exposed in the logs without requiring any supplementary configuration.</p> <p>For further information on this attack category, please consult the associated [MITRE ATT&amp;CK - Technique - Log Enumeration](https://attack.mitre.org/techniques/T1654/).</p> <p>### Patches This vulnerability is addressed by applying redaction to sensitive information that was leaking.</p> <p>Patched versions of Rancher Backup Operator include: `108.0.1+up9.0.1`, `107.1.2+up8.1.2`, `106.0.6+up7.0.5`, and `105.0.6+up6.0.3`.</p> <p>### Workarounds Users are advised to rotate both S3 `accessKey` and `secretKey` once they have upgraded to a fixed version, especially if logs are exported.</p> <p>Users who cannot update Rancher are advised to refresh the Rancher app Repository, which should provide the ability to update just the Rancher Backup chart alone. This will patch the vulnerabilities without requiring Rancher to be updated. This will not wor…</p> <p><strong>Affected:</strong> Go: github.com/rancher/backup-restore-operator</p> <p>### Impact A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both `accessKey` and `secretKey`) into the rancher-backup-operator pod&#39;s logs.</p> <p>Specifically, the S3 `accessKey` and `secretKey` are exposed in the pod&#39;s logs under the following logging level conditions:</p> <p>| Variable Exposed | Logging Level Condition | ------------------ | ------------------------- | | accessKey | `trace: false` (default), and `debug: false` (default) | | secretKey | `trace: true` or `debug: true`|</p> <p>**Note:** The S3 `accessKey` is exposed in the logs without requiring any supplementary configuration.</p> <p>For further information on this attack category, please consult the associated [MITRE ATT&amp;CK - Technique - Log Enumeration](https://attack.mitre.org/techniques/T1654/).</p> <p>### Patches This vulnerability is addressed by applying redaction to sensitive information that was leaking.</p> <p>Patched versions of Rancher Backup Operator include: `108.0.1+up9.0.1`, `107.1.2+up8.1.2`, `106.0.6+up7.0.5`, and `105.0.6+up6.0.3`.</p> <p>### Workarounds Users are advised to rotate both S3 `accessKey` and `secretKey` once they have upgraded to a fixed version, especially if logs are exported.</p> <p>Users who cannot update Rancher are advised to refresh the Rancher app Repository, which should provide the ability to update just the Rancher Backup chart alone. This will patch the vulnerabilities without requiring Rancher to be updated. This will not wor…</p> https://cve.radiocsirt.org/vuln/ghsa-wj3p-5h3x-c74q https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0276 <p>Ein Angreifer kann mehrere Schwachstellen in Rancher Manager und Backup Operator ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Rancher Manager und Backup Operator ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0276