Introduction
Remote attackers can execute arbitrary commands as root on unpatched SUSE Manager systems, in both on-premise and cloud deployments. The flaw affects organizations that rely on SUSE Manager for centralized Linux infrastructure management, and it leaves their entire environment at risk until they patch.
About SUSE and SUSE Manager: SUSE is one of the major enterprise Linux vendors and serves thousands of organizations across industries worldwide. SUSE Manager, its flagship product for managing Linux servers at scale, automates patching, configuration, and compliance across heterogeneous environments. It is widely used in enterprise and cloud settings, so a vulnerability in SUSE Manager can have a broad operational impact.
Technical Information
CVE-2025-46811 is a missing authentication vulnerability in the SUSE Manager websocket endpoint /rhn/websocket/minion/remote-commands. In affected versions the endpoint does not enforce authentication, so any user who can reach it over the network can send commands that run as root.
- Vulnerability mechanism: The websocket handler for remote commands does not verify the identity or privileges of the connecting user. Anyone who can reach the endpoint can issue arbitrary commands, and the SUSE Manager server runs them with root privileges.
- Attack vector: Remote and network-based. The attacker needs no authentication and no prior access, and can send malicious payloads directly to the websocket endpoint.
- Root cause: The websocket handler for
/rhn/websocket/minion/remote-commandshas no authentication logic, which exposes critical administrative functionality to unauthenticated users. - Classification: CWE-306 (Missing Authentication for Critical Function)
- Public exploit code: As of this writing, there are no public code samples or proof of concept.
Patch Information
SUSE has released updates for the affected components. Before the fix, unauthorized users could execute arbitrary commands as root through the websocket at /rhn/websocket/minion/remote-commands. The patch adds strict authentication checks that block this access.
Key changes in the patch:
- Authentication enforcement: The websocket endpoint now requires a valid authentication token, so only authorized users can access it and execute commands.
- Access control changes: SUSE refined the role-based access controls so that only users with the appropriate privileges can execute commands.
- Logging and monitoring: The patch adds more detailed logging of access and command execution, which helps administrators detect unauthorized activity quickly.
Pseudocode for the authentication check:
// Pseudocode representation of the authentication check if (!request.hasValidAuthToken()) { response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Authentication Required"); return; }
Recommended actions:
- Update SUSE Manager promptly to the latest version that contains the fix. The SUSE security advisories below list the specific fixed versions.
- Review user roles and permissions, and adjust them so that only authorized personnel can access critical functions.
- Monitor system logs regularly for unusual activity, especially around websocket connections and command execution.
The SUSE security advisories list the affected products, the specific package versions that contain the fixes, and instructions for applying the updates:
Detection Methods
To detect unauthorized access through the /rhn/websocket/minion/remote-commands endpoint, watch network traffic and system logs closely. Security teams should use the following methods:
- Network traffic analysis: Watch for unusual or unauthorized connections to the
/rhn/websocket/minion/remote-commandsendpoint. An unexpected increase in traffic to this endpoint may indicate exploitation attempts. - Log inspection: Review system and application logs regularly for commands executed through the websocket. Look for anomalies such as commands that ran without proper authentication, or commands that differ from normal operational patterns.
- Anomaly detection systems: Configure an intrusion detection system (IDS) or a security information and event management (SIEM) platform to alert on suspicious activity involving the websocket endpoint.
Affected Systems and Versions
CVE-2025-46811 affects the following products and versions:
- Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: All versions before 0.3.7-150600.3.6.2
- Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: All versions before 5.0.14-150600.4.17.1
- Image SLES15-SP4-Manager-Server-4-3-BYOS: All versions before 4.3.33-150400.3.55.2
- Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: All versions before 4.3.33-150400.3.55.2
- Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: All versions before 4.3.33-150400.3.55.2
- Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: All versions before 4.3.33-150400.3.55.2
- SUSE Manager Server Module 4.3: All versions before 0.3.7-150400.3.39.4 and before 4.3.33-150400.3.55.2
The official advisories have the complete list of affected and fixed versions.
Vendor Security History
SUSE has a strong record of responding quickly to vulnerabilities and communicating transparently about them. Past SUSE Manager issues have included authentication and privilege escalation vulnerabilities, but SUSE typically releases patches quickly and publishes detailed advisories. Its security maturity is considered high within the enterprise Linux ecosystem.
