CVE-2025-67601: Rancher Manager Information Disclosure Bug

CVE-2025-67601 Overview

A certificate validation bypass vulnerability has been identified in Rancher Manager that affects the Rancher CLI authentication process. When using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login command without also passing the --cacert flag, the CLI attempts to fetch CA certificates stored in Rancher's cacerts setting over an unverified connection. This creates a potential man-in-the-middle attack vector where an attacker could intercept the certificate retrieval and inject malicious certificates.

Critical Impact

This certificate validation bypass vulnerability could enable attackers to perform man-in-the-middle attacks against Rancher CLI users, potentially compromising authentication credentials and cluster access.

Affected Products

• Rancher Manager (specific versions to be confirmed via vendor advisory)
• Rancher CLI

Discovery Timeline

• 2026-02-25 - CVE CVE-2025-67601 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2025-67601

Vulnerability Analysis

This vulnerability is classified under CWE-295 (Improper Certificate Validation), which represents a fundamental flaw in the TLS/SSL certificate verification process. The issue arises from a logic error in how the Rancher CLI handles certificate verification when users specify the -skip-verify flag without providing an explicit CA certificate via the --cacert flag.

Under normal circumstances, when a user skips certificate verification, the CLI should either refuse to proceed or use a completely insecure connection mode. However, the vulnerable implementation attempts to fetch CA certificates from the Rancher server's cacerts setting to establish trust. This creates a circular trust problem: the CLI is trying to establish a secure connection by fetching certificates over an unverified channel, which defeats the purpose of certificate validation entirely.

Root Cause

The root cause lies in the Rancher CLI's certificate handling logic. When the -skip-verify flag is passed without a corresponding --cacert parameter, the CLI enters a fallback code path that attempts to retrieve CA certificates from the Rancher Manager instance. Since no certificate verification is being performed at this stage, an attacker positioned between the client and server could intercept this request and provide their own malicious CA certificate, which the CLI would then trust for subsequent authenticated communications.

Attack Vector

The attack requires network-level access to intercept communications between the Rancher CLI client and the Rancher Manager server. An attacker could exploit this vulnerability by:

1. Positioning themselves on the network path between a CLI user and the Rancher server (e.g., through ARP spoofing, DNS hijacking, or compromised network infrastructure)
2. Intercepting the CLI's request to fetch CA certificates from the cacerts endpoint
3. Responding with a malicious CA certificate controlled by the attacker
4. Using the injected certificate to intercept and potentially modify all subsequent authenticated traffic

This attack is particularly dangerous in environments where users routinely use the -skip-verify flag for convenience when working with self-signed certificates, which is common in development and testing environments that may have access to production resources.

Detection Methods for CVE-2025-67601

Indicators of Compromise

• Unusual SSL/TLS certificate warnings or errors during Rancher CLI operations
• Unexpected certificate changes in the Rancher cacerts configuration
• Network traffic anomalies indicating potential man-in-the-middle positioning
• Login failures followed by successful authentications from the same user in short succession

Detection Strategies

• Monitor network traffic for unencrypted or improperly verified connections to Rancher Manager endpoints
• Implement certificate pinning monitoring to detect unexpected certificate changes
• Review Rancher CLI usage logs for instances of -skip-verify flag usage without --cacert
• Deploy network intrusion detection systems to identify ARP spoofing or DNS hijacking attempts

Monitoring Recommendations

• Enable verbose logging on Rancher Manager to track CLI authentication attempts
• Implement alerting for certificate-related configuration changes in Rancher
• Monitor for multiple authentication attempts from single users that may indicate credential replay
• Review network logs for suspicious traffic patterns between CLI clients and Rancher Manager

How to Mitigate CVE-2025-67601

Immediate Actions Required

• Always use the --cacert flag with the appropriate CA certificate when using the Rancher CLI with self-signed certificates
• Avoid using the -skip-verify flag in production environments
• Review CLI usage patterns and update automation scripts to include proper certificate validation
• Consider implementing network-level security controls to prevent man-in-the-middle attacks

Patch Information

A security advisory has been published for this vulnerability. Review the GitHub Rancher Security Advisory for specific patch information and updated versions. Additional tracking is available through the SUSE Bugzilla.

Workarounds

• Always specify the --cacert flag with a valid CA certificate when using the -skip-verify option
• Use trusted CA-signed certificates instead of self-signed certificates where possible
• Implement network segmentation to isolate Rancher management traffic
• Use VPN or other encrypted tunnels when accessing Rancher from untrusted networks

# Secure Rancher CLI login with proper certificate validation
rancher login https://rancher.example.com --token your-token --cacert /path/to/ca-certificate.pem

# If self-signed certificates are required, always include both flags
rancher login https://rancher.example.com --token your-token --cacert /path/to/ca-certificate.pem