Go Package Vulnerabilities

Open in search

Vulnerabilities associated with github.com/rancher/rancher.

Packages

Clear package

Showing 25 vulnerabilities on this page for github.com/rancher/rancher

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Over-inclusive team membership expansion in GitHub App authentication provider for Rancher

Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.

CWE-303Jun 30, 2026
CVSS8.8v3.1EPSS0.454%PoCs0SignalsSTIX

Rancher Privilege Escalation from Project Owner to Host

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.

CWE-305Jun 29, 2026
CVSS9.4v4.0EPSS0.414%PoCs0SignalsSTIX

Command injection through unsanitized YAML parameter in Rancher

A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.

CWE-95Jun 19, 2026
CVSS9.4v4.0EPSS1.28%PoCs0SignalsSTIX

Rancher Extensions have arbitrary file access via path traversal

A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to: * Overwrite Rancher binaries or configuration to inject code. * Write to /var/lib/rancher/ to tamper with cluster state. * If hostPath volumes are mounted, wri…

CWE-35May 13, 2026
CVSS8.4v3.1EPSS0.369%PoCs0SignalsSTIX

Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user

### Impact The `restricted` pod security policy (PSP), provided in Rancher versions from 2.0 up to and including 2.6.3, has a deviation from the [upstream](https://github.com/kubernetes/website/blob/6d22e08903d7dd44b049c4689fa882ae07f67de9/content/en/examples/policy/restricted-psp.yaml) `restricted` policy provided in Kubernetes, in which Rancher's PSP has `runAsUser` set to `runAsAny`, while upstream has `runAsUser` set to `MustRunAsNonRoot`. This allows containers to run as any user, including…

CWE-862Mar 3, 2026
CVSS-v4.0EPSS-PoCs0SignalsSTIX

Rancher CLI skips TLS verification on Rancher CLI login command

A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login command without also passing the –cacert flag results in the CLI attempting to fetch CA certificates stored in Rancher’s setting cacerts.

CWE-295Feb 25, 2026
CVSS8.3v3.1EPSS0.153%PoCs0SignalsSTIX

Rancher exposes sensitive information through audit logs

A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs.

CWE-532Oct 29, 2025
CVSS4.3v3.1EPSS0.267%PoCs0SignalsSTIX

Rancher user retains access to clusters despite Global Role removal

A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters. This only affects custom Global Roles that have a * on * in * rule for resources or have a * on * rule for non-resource URLs

CWE-281Oct 29, 2025
CVSS4.3v3.1EPSS0.205%PoCs0SignalsSTIX

Rancher update on users can deny the service to the admin

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts.

CWE-863Oct 2, 2025
CVSS7.6v3.1EPSS0.453%PoCs0SignalsSTIX

Rancher CLI SAML authentication is vulnerable to phishing attacks

A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phishing attacks. The custom authentication protocol for SAML-based providers can be abused to steal Rancher’s authentication tokens.

CWE-345Oct 2, 2025
CVSS8.0v3.1EPSS0.217%PoCs0SignalsSTIX

Rancher sends sensitive information to external services through the `/meta/proxy` endpoint

A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.

CWE-200Oct 2, 2025
CVSS4.7v3.1EPSS0.334%PoCs0SignalsSTIX

Rancher affected by unauthenticated Denial of Service

A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing, leading to Denial of Service (DoS).

CWE-770Sep 2, 2025
CVSS8.2v3.1EPSS0.517%PoCs0SignalsSTIX

Rancher users who can create Projects can gain access to arbitrary projects

### Impact A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project. Please consult th…

CWE-863Apr 25, 2025
CVSS-v3.1EPSS-PoCs0SignalsSTIX

Rancher's External RoleTemplates can lead to privilege escalation

A Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can lead to privilege escalation in specific scenarios.This issue affects rancher: from 2.7.0 before 2.7.14, from 2.8.0 before 2.8.5.

CWE-269CWE-732Apr 16, 2025
CVSS7.5v4.0EPSS0.606%PoCs0SignalsSTIX

Rancher Remote Code Execution via Cluster/Node Drivers

A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root access to the Rancher container itself. In production environments, further privilege escalation is possible based on living off the land within the Rancher container itself. For the test and development environments, based on a –privileged Docker container, it is possible to escape the Docker container and gain execution access on the host system. This is…

CWE-269Apr 16, 2025
CVSS9.1v3.1EPSS0.759%PoCs0SignalsSTIX

Stored Cross-site Scripting vulnerability in Rancher UI

A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field. This issue affects rancher: from 2.9.0 before 2.9.4.

CWE-79Apr 16, 2025
CVSS8.9v3.1EPSS0.525%PoCs0SignalsSTIX

Rancher Helm Applications may have sensitive values leaked

A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps Catalog to read any sensitive information that are contained within the Apps’ values. Additionally, the same information leaks into auditing logs when the audit level is set to equal or above 2. This issue affects rancher: from 2.8.0 before 2.8.10, from 2.9.0 before 2.9.4.

CWE-200Apr 11, 2025
CVSS6.2v3.1EPSS0.423%PoCs0SignalsSTIX

Rancher's SAML-based login via CLI can be denied by unauthenticated users

A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.

CWE-200Apr 11, 2025
CVSS5.3v3.1EPSS0.527%PoCs0SignalsSTIX

Unauthenticated stack overflow in /v3-public/authproviders API

A Stack-based Buffer Overflow vulnerability in SUSE rancher allows for denial of service.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.

CWE-121Apr 11, 2025
CVSS8.2v3.1EPSS0.585%PoCs0SignalsSTIX

Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login

A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.

CWE-284CWE-287Apr 11, 2025
CVSS8.4v3.1EPSS0.462%PoCs0SignalsSTIX

Rancher: Restricted Administrator can change Administrator's passwords

A Incorrect Privilege Assignment vulnerability in SUSE rancher allows a Restricted Administrator to change the password of Administrators and take over their accounts. This issue affects rancher: from 2.8.0 before 2.8.14, from 2.9.0 before 2.9.8, from 2.10.0 before 2.10.4.

CWE-266Apr 11, 2025
CVSS9.1v3.1EPSS0.451%PoCs0SignalsSTIX

Exposure of vSphere's CPI and CSI credentials in Rancher

A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.

CWE-522Nov 13, 2024
CVSS8.5v4.0EPSS0.438%PoCs0SignalsSTIX

Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec

A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling, the Kube API secret values are written in plaintext on the AppliedSpec. Cluster owners, Cluster members, and Project members (for projects within the cluster), all have RBAC permissions to view the cluster object from the apiserver.

CWE-200CWE-256Oct 16, 2024
CVSS7.1v4.0EPSS0.374%PoCs0SignalsSTIX

Rancher agents can be hijacked by taking over the Rancher Server URL

A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability. The targeted domain is the one used as the Rancher URL.

CWE-295Oct 16, 2024
CVSS8.0v3.1EPSS0.419%PoCs0SignalsSTIX

Rancher's External RoleTemplates can lead to privilege escalation

A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific scenarios can lead to privilege escalation.

CWE-269Oct 16, 2024
CVSS7.5v4.0EPSS0.549%PoCs0SignalsSTIX