Self-Signed CA Certificate Vulnerability in Rancher Manager by Rancher

CVE-2025-67601

What is CVE-2025-67601?

A vulnerability has been discovered in Rancher Manager that arises when users utilize self-signed CA certificates without properly configuring the Rancher CLI. Specifically, passing the -skip-verify flag during login without the -cacert flag leads to the CLI making attempts to retrieve CA certificates from the settings, potentially exposing the system to security risks. It is crucial for users to ensure that the appropriate flags are implemented to safeguard against unauthorized access and other associated threats.

References