{"id":"EUVD-2025-31337","revision":"dc732c899748428c93ad1940dc082772","records":[{"revision":"dc732c899748428c93ad1940dc082772","observedAt":"2026-11-07T02:38:21.999+00:00","statement":{"source":"euvd","id":"EUVD-2025-31337","aliases":["CVE-2025-54468","GHSA-mjcp-rj3c-36fr"],"title":"A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiab…","description":"A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","score":4.7,"severity":null}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54468","https://github.com/rancher/rancher/security/advisories/GHSA-mjcp-rj3c-36fr"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31337","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 2, 2025, 10:00:18 AM","dateUpdated":"Oct 2, 2025, 2:10:23 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2025:15666-1","title":"govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media","vulnerabilityIds":["CVE-2024-58260","CVE-2024-58267","CVE-2025-23266","CVE-2025-23267","CVE-2025-54468","CVE-2025-55191","CVE-2025-59163","CVE-2025-59531","CVE-2025-59537","CVE-2025-59538","CVE-2025-59823","CVE-2025-59824","CVE-2025-59941","CVE-2025-59942","CVE-2025-59956","CVE-2025-61595","CVE-2025-61926"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-31337","identifiers":["EUVD-2025-31337","CVE-2025-54468","GHSA-mjcp-rj3c-36fr"]},"retained":false,"historicalAffected":[]}],"coverage":[]}