CVE-2025-62879

4.9 mediumEPSS 0.4%

A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-backup-operator pod's logs.

Severity

CVSS 3.1

4.9 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE: CWE-532
Published: 2026-03-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

suse:rancher_backup_and_restore_operator

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-wj3p-5h3x-c74q	Go	github.com/rancher/backup-restore-operator	>=9.0.0 <9.0.1	9.0.1
GHSA-wj3p-5h3x-c74q	Go	github.com/rancher/backup-restore-operator	>=8.0.0 <8.1.2	8.1.2
GHSA-wj3p-5h3x-c74q	Go	github.com/rancher/backup-restore-operator	>=7.0.0 <7.0.5	7.0.5
GHSA-wj3p-5h3x-c74q	Go	github.com/rancher/backup-restore-operator	>=6.0.0 <6.0.3	6.0.3
GO-2026-4591	Go	github.com/rancher/backup-restore-operator	all versions	no fix published

References

Check your stack JSON