CVE-2025-67601 is a vulnerability classified under CWE-295 (Improper Certificate Validation) found in SUSE Rancher Manager, specifically affecting versions 0 through 2.13.0. The issue arises when administrators use self-signed CA certificates and invoke the Rancher CLI login command with the -skip-verify flag but omit the –cacert flag. Under these conditions, the CLI attempts to retrieve CA certificates from Rancher’s internal settings (cacerts), which may be manipulated or insufficiently validated. This improper validation can lead to acceptance of untrusted or malicious certificates, enabling attackers to perform man-in-the-middle (MITM) attacks or spoof Rancher server identities. The vulnerability has a CVSS 3.1 base score of 8.3, reflecting network attack vector, high complexity, no privileges required, user interaction required, and a scope change with high impact on confidentiality, integrity, and availability. Although no exploits are known in the wild yet, the flaw’s nature and Rancher’s widespread use in Kubernetes cluster management make it a significant risk. The vulnerability highlights the risk of insecure CLI usage patterns combined with self-signed certificates and insufficient certificate validation mechanisms within Rancher’s CLI tooling.

The vulnerability could allow attackers to intercept or manipulate communications between the Rancher CLI and the Rancher Manager server by exploiting improper certificate validation. This can lead to unauthorized disclosure of sensitive cluster management credentials, unauthorized command execution, or disruption of cluster operations. Given Rancher’s role in managing Kubernetes clusters, a successful attack could compromise container orchestration environments, leading to potential lateral movement within cloud or on-premises infrastructure, data breaches, or denial of service. The high CVSS score indicates severe impacts on confidentiality, integrity, and availability. Organizations relying on Rancher for critical infrastructure management are at risk of operational disruption and data compromise if this vulnerability is exploited.

Organizations should immediately audit their use of the Rancher CLI login command, ensuring that when using self-signed CA certificates, the –cacert flag is always specified alongside or instead of the -skip-verify flag to enforce proper certificate validation. Avoid using the -skip-verify flag unless absolutely necessary and understand its implications. Administrators should update Rancher Manager and CLI tools to the latest patched versions once available from SUSE. In the interim, restrict CLI access to trusted networks and users, monitor Rancher logs for unusual authentication attempts, and consider implementing network-level protections such as TLS interception detection and strict firewall rules. Additionally, educate users on secure certificate handling practices and review Rancher’s stored CA certificates for unauthorized changes. Employ multi-factor authentication and role-based access controls to limit the impact of potential credential compromise.