Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/rancher/backup-restore-operator

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.8GoPublished

    Rancher Backup Operator pod's logs leak S3 tokens

    CVE-2025-62879 · GHSA-wj3p-5h3x-c74q

    Affected
    • Go github.com/rancher/backup-restore-operator >= 9.0.0, < 9.0.1; >= 8.0.0, < 8.1.2; >= 7.0.0, < 7.0.5; >= 6.0.0, < 6.0.3
    Fixed in
    6.0.38.1.29.0.17.0.5· Vendor fix available
    Issue
    Impact A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-backup-operator pod's logs. Specifically, the S3 accessKey and secretKey are exposed in the pod's logs under the following logging level conditions: | Variable Exposed | Logging Level Condition | ------------------ | ------------------------- | | accessKey | trace: false (default), and debug: false (default) | | secretKey | trace: true or debug: true| Note: The S3 accessKey is exposed in the logs without requiring any supplementary configuration. For further information on this attack category, please consult the associated MITRE ATT&CK - Technique - Log Enumeration. Patches This vulnerability is addressed by applying redaction to sensitive information that was leaking. Patched versions of Rancher Backup Operator include: 108.0.1+up9.0.1, 107.1.2+up8.1.2, 106.0.6+up7.0.5, and 105.0.6+up6.0.3. Workarounds Users are advised…

    Recommended action: Upgrade to 9.0.1, 8.1.2, 7.0.5 or 6.0.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →