SUSE Rancher Security Team Patches Three Vulnerabilities in Rancher Manager

The SUSE Rancher Security Team has issued fixes for three vulnerabilities affecting Rancher Manager, with severities ranging from Medium to High and potential impacts including denial of service, information leakage, and phishing-enabled token theft.

CVE-2024-58260 concerns username manipulation that can lock out admins; the advisory notes that a user permitted to update another user’s resource can set its username to ‘admin’, with Rancher now blocking username modifications once set and the fixes available in v2.12.2, v2.11.6, v2.10.10, and v2.9.12.

CVE-2025-54468 involves sensitive header leakage via the /meta/proxy, where impersonate- headers could be exposed to external entities; Rancher now strips all Impersonate- headers from proxied requests, with patches identical to the others. CVE-2024-58267 enables SAML phishing through the Rancher CLI, allowing an attacker to craft a phishing login URL; updates to both Rancher Manager and CLI include visibility of the requestId and a warning on the login page, fixed in the same patched versions.