CVE-2025-23387: SUSE Rancher Information Disclosure Flaw

CVE-2025-23387 Overview

CVE-2025-23387 is an information disclosure vulnerability in SUSE Rancher that allows unauthenticated users to enumerate and delete command-line interface (CLI) authentication tokens. The flaw resides in the token retrieval flow used during CLI login. Attackers can list all pending CLI authentication tokens and delete them before the legitimate CLI client retrieves the token value. The vulnerability affects Rancher versions 2.8.0 before 2.8.13, 2.9.0 before 2.9.7, and 2.10.0 before 2.10.3. This weakness is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can interfere with CLI login flows by enumerating and deleting authentication tokens, disrupting cluster administration operations in affected Rancher deployments.

Affected Products

SUSE Rancher 2.8.0 through 2.8.12
SUSE Rancher 2.9.0 through 2.9.6
SUSE Rancher 2.10.0 through 2.10.2

Discovery Timeline

2025-04-11 - CVE-2025-23387 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23387

Vulnerability Analysis

Rancher exposes an API endpoint used to complete CLI authentication. During CLI login, a token record is created and later retrieved by the CLI client using a token identifier. The endpoint responsible for listing and managing these token records did not enforce authentication for the list and delete operations. Unauthenticated network clients can therefore query the endpoint, retrieve identifiers for pending CLI authentication tokens, and issue delete requests against them.

By deleting the token before the legitimate CLI process fetches its value, an attacker prevents the administrator from completing login. This produces a denial-of-service condition against the CLI authentication workflow. The vulnerability does not directly reveal token secrets, but it exposes metadata about active authentication attempts to unauthorized parties.

Root Cause

The root cause is a missing authorization check on the CLI token management endpoint. The handler treated list and delete operations as safe to expose, but they act on records that belong to individual users mid-authentication. Without a session or bearer token requirement, any network-reachable client can operate on these records.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker with HTTPS access to the Rancher management endpoint can repeatedly poll the CLI token collection and delete newly created entries. See the GitHub Security Advisory GHSA-5qmp-9x47-92q8 for vendor-provided technical details.

No verified public proof-of-concept code is available. Refer to the advisory for technical specifics rather than synthetic exploit code.

Detection Methods for CVE-2025-23387

Indicators of Compromise

Unauthenticated HTTP requests to Rancher CLI token endpoints originating from unexpected source addresses.
Repeated DELETE operations against CLI token resources within short time windows.
Administrator reports of failed rancher login CLI attempts where the browser flow completes but the CLI never receives a token.

Detection Strategies

Enable audit logging on the Rancher API server and alert on unauthenticated access to CLI token routes.
Correlate ingress logs with Rancher audit events to identify anonymous callers performing list or delete operations on token collections.
Baseline normal CLI login volume per tenant and alert on statistical deviations that suggest enumeration.

Monitoring Recommendations

Forward Rancher audit logs and Kubernetes API server logs to a centralized SIEM for retention and analysis.
Monitor reverse proxy or load balancer logs in front of Rancher for anonymous requests targeting authentication endpoints.
Track the rate of created versus consumed CLI tokens to detect deletion attacks disrupting the login flow.

How to Mitigate CVE-2025-23387

Immediate Actions Required

Upgrade Rancher to version 2.8.13, 2.9.7, 2.10.3, or later depending on your deployment branch.
Restrict network exposure of the Rancher management interface to trusted administrator networks and VPN ranges.
Review recent audit logs for anonymous access to CLI token endpoints and unusual token deletion patterns.

Patch Information

SUSE has released fixed Rancher versions 2.8.13, 2.9.7, and 2.10.3 that enforce authentication on the CLI token management endpoints. Consult the SUSE Bugzilla entry for CVE-2025-23387 and the Rancher GitHub Security Advisory GHSA-5qmp-9x47-92q8 for upgrade guidance.

Workarounds

Place Rancher behind an authenticating reverse proxy that blocks anonymous requests to /v3/tokens and related CLI authentication paths.
Limit inbound access to the Rancher API to known administrative CIDR ranges using network policies or firewall rules.
Instruct administrators to prefer kubeconfig-based access until the upgrade is applied, reducing reliance on the CLI token flow.

bash

# Example: Helm upgrade to a patched Rancher release
helm repo update
helm upgrade rancher rancher-stable/rancher \
  --namespace cattle-system \
  --version 2.10.3