6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62879

CVE-2025-62879: Rancher Backup Operator pod's logs leak S3 tokens

A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-backup-operator pod's logs.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62879

CVE-2025-62879:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/rancher/backup-restore-operator	go	>= 9.0.0, < 9.0.1	9.0.1
github.com/rancher/backup-restore-operator	go	>= 8.0.0, < 8.1.2	8.1.2
github.com/rancher/backup-restore-operator	go	>= 7.0.0, < 7.0.5	7.0.5
github.com/rancher/backup-restore-operator	go	>= 6.0.0, < 6.0.3	6.0.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by the logging of sensitive S3 credentials (accessKey and secretKey) by the rancher-backup-operator. By analyzing the patch that fixes this vulnerability, specifically commit 9fc04f18a1dddb9c23321b4883fa344f7aa68bd0, I identified the exact functions responsible for this leakage.

The changes in pkg/objectstore/s3minio.go clearly show where the logging occurs. The function objectstore.SetS3Service logged the S3 access key. The patch redacts this key before logging. The function objectstore.GetS3Client logged the access key at the debug level and the secret key at the trace level. The patch redacts the access key and removes the secret key from the log message entirely.

Therefore, during the operation of the backup operator, these two functions, objectstore.SetS3Service and objectstore.GetS3Client, would be invoked, leading to the exposure of sensitive credentials in the logs if the appropriate log levels are enabled.

Vulnerable functions

objectstore.SetS3Service

pkg/objectstore/s3minio.go

This function logs the S3 access key when setting up the S3 service client. The patch redacts the access key before logging it.

objectstore.GetS3Client

pkg/objectstore/s3minio.go

This function logs the S3 access key at the debug level and the secret key at the trace level when retrieving S3 credentials from a Kubernetes secret. The patch redacts the access key and removes the secret key from the log messages.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.