CVE-2025-46809: SUSE Manager Password Disclosure Vulnerability

CVE-2025-46809 Overview

CVE-2025-46809 is a plaintext credential storage vulnerability affecting SUSE Manager Proxy and Server components. The flaw exposes HTTP proxy credentials in log files, allowing users with read access to those logs to recover the plaintext password. The issue is classified under [CWE-256] (Plaintext Storage of a Password) and impacts multiple SUSE Manager container images and appliance images across the 4.3 and 5.0 product lines.

Critical Impact
HTTP proxy credentials written to SUSE Manager log files can be recovered by any actor with access to those logs, enabling downstream compromise of the proxied services.

Affected Products

SUSE Manager Proxy Module 4.3 before 4.3.33-150400.3.55.2 (container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1 and SLES15-SP4 Manager-Proxy-4-3-BYOS images including Azure, EC2, and GCE variants)
SUSE Manager Server Module 4.3 before 4.3.33-150400.3.55.2 (SLES15-SP4 Manager-Server-4-3-BYOS images including Azure, EC2, and GCE variants)
SUSE Manager 5.0 containers before 5.0.14-150600.4.17.1 (suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1 and suse/manager/5.0/x86_64/server:5.0.5.7.30.1)

Discovery Timeline

2025-07-31 - CVE-2025-46809 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46809

Vulnerability Analysis

SUSE Manager Proxy and Server components write HTTP proxy authentication credentials to log files in plaintext. When the affected proxy-httpd service is configured to use an upstream HTTP proxy that requires authentication, the username and password are recorded in log output without redaction or masking. Any account with read access to those log files can extract the credentials directly.

The vulnerability is a storage flaw rather than a transport flaw. It does not require network interception. It requires only that an actor reach the log data through normal system access, a log aggregation pipeline, a backup, or a support bundle.

Root Cause

The root cause is missing sanitization of sensitive fields in the logging path. Credentials passed as part of the HTTP proxy configuration are serialized into diagnostic or operational log output verbatim. [CWE-256] applies because a secret is stored in a recoverable, unencrypted form outside its intended credential store.

Attack Vector

An attacker requires local or delegated access to the log files on the affected container or host. This includes operators with limited privileges, log-forwarding infrastructure, off-host log archives, and support bundles shared with third parties. Once the credentials are recovered, the attacker can authenticate to the upstream HTTP proxy and pivot to any resources that proxy fronts. No verified public exploit code has been released for this issue.

The vulnerability is described in prose only; no verified proof-of-concept code is available. See the SUSE Bug Report CVE-2025-46809 for technical details.

Detection Methods for CVE-2025-46809

Indicators of Compromise

Presence of http_proxy, https_proxy, or proxy_user strings alongside plaintext passwords in SUSE Manager proxy-httpd log files
Log entries containing URL-encoded credentials in the form http(s)://user:password@proxyhost inside SUSE Manager operational logs
Log files, support bundles, or backups from affected versions shared with external parties before patching

Detection Strategies

Grep log directories on SUSE Manager Proxy and Server hosts for patterns matching ://[^:]+:[^@]+@ to identify credential exposure
Audit centralized log aggregation platforms for historical ingestion of SUSE Manager logs that predate the fixed package versions
Review access records for any account that read proxy-httpd logs on affected systems to scope potential exposure

Monitoring Recommendations

Alert on read access to SUSE Manager log directories by non-administrative accounts
Rotate and purge historical logs after patching to ensure exposed credentials cannot be recovered from archives
Track outbound authentication events against the HTTP proxy for reuse of credentials that may have been exposed

How to Mitigate CVE-2025-46809

Immediate Actions Required

Upgrade SUSE Manager 4.3 Proxy and Server packages to 4.3.33-150400.3.55.2 or later
Upgrade SUSE Manager 5.0 proxy-httpd and server containers to 5.0.14-150600.4.17.1 or later
Rotate any HTTP proxy credentials that were configured on affected systems prior to patching
Purge or securely archive historical log files, support bundles, and backups that may contain the exposed credentials

Patch Information

SUSE has released fixed packages and container images for both the 4.3 and 5.0 product lines. Refer to the SUSE Bug Report CVE-2025-46809 for advisory metadata and the complete list of fixed image tags. Apply updates through zypper for module-based installs, and pull the updated container tags for containerized deployments.

Workarounds

Restrict filesystem permissions on SUSE Manager log directories to root-owned, mode 0600 where operationally feasible until patches are applied
Remove HTTP proxy authentication from the SUSE Manager configuration, or move the credential to a network-level allowlist, if patching must be deferred
Exclude SUSE Manager proxy-httpd logs from third-party support bundles and external log forwarding until fixed versions are deployed

bash

# Configuration example: apply the fixed SUSE Manager packages
zypper refresh
zypper update susemanager-proxy susemanager-server

# Verify fixed version is installed
rpm -q susemanager-proxy susemanager-server

# Rotate HTTP proxy credentials after patching, then purge stale logs
find /var/log/rhn -type f -name '*.log*' -exec shred -u {} \;