Rancher CLI skips TLS verification on Rancher CLI login command

A vulnerability in Rancher Manager (CVE-2025-67601) arises when the CLI login command is used with self-signed CA certificates and the -skip-verify flag, but without the -cacert flag. In this scenario, the CLI attempts to fetch CA certificates stored in Rancher's cacerts setting, bypassing explicit certificate verification [1][2][4].

An attacker with network-level access between the Rancher CLI and Rancher Manager can exploit this by interfering with the TLS handshake to return a CA they control, despite the use of the --skip-verify flag. This allows the attacker to bypass TLS as a security control and potentially view basic authentication headers in a Man-in-the-Middle (MITM) attack [4].

The impact includes the ability to bypass TLS verification, leading to potential credential exposure and unauthorized access. The vulnerability does not apply to other commands and only affects the login command when the -cacert flag is omitted [2][4].

This issue is addressed in patched versions of Rancher: v2.13.2, v2.12.6, v2.11.10, and v2.10.11, which remove the ability to fetch CA certificates from cacerts during login. If upgrading is not possible, the workaround is to always explicitly pass CA certificates with the -cacert flag when using the login command [1][4].