CVE-2025-62879: Rancher Backup Operator pod's logs leak S3 tokens

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-04 · updated 2026-06-17
Weakness: CWE-532

Description

A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-backup-operator pod's logs.

Affected products

SUSE Rancher Backup And Restore Operator: from 6.0.0 before 6.0.3; from 7.0.0 before 7.0.5; from 8.0.0 before 8.1.2; from 9.0.0 before 9.0.1 — fixed in 6.0.3, 7.0.5, 8.1.2, 9.0.1

How to fix

Upgrade to a fixed version: SUSE Rancher Backup And Restore Operator 6.0.3, 7.0.5, 8.1.2, 9.0.1. Check the vendor advisory for mitigations.

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-62879
https://github.com/advisories/GHSA-wj3p-5h3x-c74q

Get alerted when CVE-2025-62879 or the next vulnerability affects your stack