{"id":"CVE-2025-54468","revision":"0197be97652b4d929573878cecdd8624","records":[{"revision":"0197be97652b4d929573878cecdd8624","observedAt":"2026-10-25T02:25:06.051+00:00","statement":{"source":"nvd","id":"CVE-2025-54468","aliases":[],"title":"A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiab…","description":"A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.","state":0,"publishedAt":"2025-10-02T10:15:39.727+00:00","modifiedAt":"2026-10-12T15:10:00.207+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · meissner@suse.de · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","score":4.7,"severity":"MEDIUM"}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54468","https://github.com/rancher/rancher/security/advisories/GHSA-mjcp-rj3c-36fr"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-54468","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-200"],"productCriteria":[],"sourceDates":{"published":"2025-10-02T10:15:39.727","lastModified":"2026-10-12T15:10:00.207"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-54468","identifiers":["CVE-2025-54468"]},"retained":false,"historicalAffected":[]}],"coverage":[]}