SUSE Rancher Unauthenticated Cluster ID Enumeration Vulnerability (CVE-2025-5598) Advisory

Vulnerability Overview Title: Cluster Existence Oracle via Unauthenticated Import Endpoint Description: Rancher's unauthenticated cluster import endpoint allows external attackers to enumerate valid cluster IDs and determine whether a cluster is configured with a private registry secret. Impact: Enumeration of valid Rancher cluster IDs Identification of clusters configured with private registry secrets Information gathering for subsequent attacks Affected Versions Affected Versions: - >=2.14.0, =2.13.0, =2.12.0, =2.11.0, <2.11.16 Unaffected Versions: - 2.14.4 - 2.13.8 - 2.12.12 - 2.11.16 Remediation Patch: Validate the token before loading the cluster object, so that invalid or unauthenticated requests do not reach the cluster lookup and private registry code paths. After applying the patch, invalid requests will receive a uniform response, regardless of whether the cluster exists or its configuration. Workaround: If immediate upgrade to the patched version is not possible, exposure can be reduced by restricting network access to the Rancher API ( ). This can be achieved using firewalls, reverse proxies, or network policies to prevent requests from untrusted sources from reaching the endpoint. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: None - Availability: None CVE ID: CVE-2025-5598 Weakness: CWE-304 Credit: Discovered and reported by Michael Wollner (@ibonik) from Deutsche Telekom AG. More Information Contact the SUSE Rancher Security Team for security-related inquiries. Open an issue in the Rancher repository. View the support matrix and product support lifecycles. POC Code Summary This vulnerability allows unauthenticated attackers to enumerate valid cluster IDs via Rancher's unauthenticated cluster import endpoint and determine whether a cluster is configured with a private registry secret. Affected versions include 2.14.0 to 2.14.3, 2.13.0 to 2.13.7, 2.12.0 to 2.12.11, and 2.11.0 to 2.11.15. Remediation includes upgrading to the patched version or restricting network access to the Rancher API.

Goal Reached Thanks to every supporter — we hit 100%!

SUSE Rancher Unauthenticated Cluster ID Enumeration Vulnerability (CVE-2025-5598) Advisory

More from this source