A vulnerability in the Rancher CLI allows for potential certificate validation bypass during login, posing a significant risk of man in the middle attacks.

This flaw involves improper certificate validation (CWE-295) where the Rancher CLI, when invoked with the -skip-verify flag but missing the --cacert flag, incorrectly attempts to fetch CA certificates from the server setting. This represents an unauthenticated attack vector requiring user interaction, which could facilitate traffic interception.

Successful exploitation of this vulnerability could allow an attacker to intercept or manipulate sensitive administrative traffic between the CLI and the Rancher server. Given the CVSS score of 8.3, this represents a high risk to organizational integrity, as it may lead to the compromise of credentials or administrative session tokens, effectively bypassing authentication controls and enabling unauthorized access to container orchestration infrastructure.

Immediate Action: Upgrade to the patched versions: 2.13.2, 2.12.6, 2.11.10, or 2.10.11. If an immediate update is not feasible, ensure that the --cacert flag is consistently provided when using the Rancher CLI to establish secure connections.

Proactive Monitoring: Review access logs for anomalous Rancher CLI authentication patterns or unexpected certificate negotiation errors that may indicate failed exploitation attempts.

Compensating Controls: Enforce strict network segmentation for administrative interfaces and ensure that all CLI interactions occur over trusted, encrypted management networks to minimize the impact of potential traffic interception.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the potential for administrative credential compromise, necessitates prompt attention. Security teams should prioritize patching affected Rancher Manager instances to the versions specified above. Until patches are applied, users must be educated to avoid relying on the -skip-verify flag without proper certificate pinning or explicit CA validation via the --cacert parameter.