Servers and applications
CVE-2025-54468
Sensitive information is sent to external services through Rancher’s `/meta/proxy` endpoint
- Severity
- Medium 4.7
- Published
- 25 Sept 2025
- Last changed
- 25 Sept 2025
- Added to UpHeron
- 3 Nov 2026
- Fixed in
- 2.9.12, 2.10.10, 2.11.6, 2.12.2
- Also known as
- GHSA-mjcp-rj3c-36fr
- Sources
- Project advisories (GitHub)
Affected software
| Software | Affected versions |
|---|---|
RancherServers and applications · github:rancher/rancher |
|
References
- CVE.org https://www.cve.org/CVERecord?id=CVE-2025-54468
- GitHub Advisory Database https://github.com/advisories/GHSA-mjcp-rj3c-36fr
- github.com https://github.com/rancher/rancher/security/advisories/GHSA-mjcp-rj3c-36fr