Skip to content
Threat Feed
Subscribe
high advisory

SUSE Rancher Meta Proxy Allowlist Bypass SSRF

SUSE Rancher is vulnerable to a meta proxy allowlist bypass that results in server-side request forgery (SSRF), allowing potential unauthorized internal network requests.

Triage facts

Revision 1
Applicability
Rancher (< 2.11.19), Rancher (2.12.0 - 2.12.14) +3
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Nov 2, 21:21 UTC
Source quality
A1Likely

A security vulnerability exists in SUSE Rancher, specifically within its meta proxy component, which allows for an allowlist bypass. This vulnerability can lead to server-side request forgery (SSRF), potentially enabling attackers to make unauthorized requests to internal resources that should be restricted. Administrators should apply the provided updates immediately.

Recommendation

  • Update Rancher instances to the following patched versions to address the meta proxy allowlist bypass:
  • 2.11.19
  • 2.12.15
  • 2.13.11
  • 2.14.7
  • 2.15.3
  • Review Rancher logs for anomalous outbound HTTP requests originating from the cluster management API or proxy components.

Immediate actions

Upgrade all Rancher deployments to the specified patched versions

IT Operations 48h

Threat Hunt

Hunt for anomalous requests to internal metadata services (e.g., 169.254.169.254) or internal IP ranges originating from the Rancher server process

T1046 high medium confidence hunt now

Data: Rancher container network logs, VPC/Cloud flow logs

Mitigations

Upgrade to patched versions: 2.11.19, 2.12.15, 2.13.11, 2.14.7, or 2.15.3

immediate IT Operations

Meta proxy allowlist bypass SSRF