Silent Leak: High-Severity Rancher CLI Flaw Exposes Admin Credentials

A high-severity vulnerability (CVE-2025-67601, CVSS 8.4) in the Rancher CLI causes TLS protections to be undermined when administrators use --skip-verify with self-signed certificates but do not pass -cacert; the CLI may fall back to fetching stored CA certificates, enabling a network-level attacker to perform a man-in-the-middle, view basic auth headers, and harvest credentials. SUSE Rancher issued patches (v2.13.2, v2.12.6, v2.11.10, v2.10.11) and advises users unable to upgrade to always pass explicit CA certificates with -cacert.