Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,292

Export CSV
CVE-2024-6387

Openssh: regresshion - race condition in ssh allows rce/dos

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

CVSS 3.1 · 8.1 High EPSS 99.5% KEV · Not listed
Vendors
Almalinux Amazon Apple and 10 more
Products
Almalinux Amazon Linux Macos and 83 more
CVE-2026-104615

Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace

A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher
CVE-2026-116472

ingress-nginx mirror-target self-DOS

A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx. Due to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly. In principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Kubernetes Suse
Products
Ingress-nginx Rancher Prime Rke2 Ingress-nginx
CVE-2024-12086

Rsync: rsync server leaks arbitrary client files

A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.

CVSS 3.1 · 6.1 Medium EPSS 1.8% KEV · Not listed
Vendors
Almalinux Archlinux Gentoo and 5 more
Products
Almalinux Arch Linux Linux and 10 more
CVE-2025-6018

Pam-config: lpe from unprivileged to allow_active in pam

A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed
Vendors
Redhat Suse
Products
Enterprise Linux Rhel Els Pam-config
CVE-2015-5477

bind: TKEY query handling flaw leading to denial of service

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

CVSS 3.1 · 7.5 High EPSS 99.6% KEV · Listed
Vendors
Apple Canonical Debian and 10 more
Products
Os X Server Ubuntu Linux Debian Linux and 76 more
CVE-2026-75034

Rancher: SAML Assertion Replay

A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim. This issue affects Rancher: before 2.15.1.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher
CVE-2026-44939

Command injection through unsanitized YAML parameter in Rancher

A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.

CVSS 4.0 · 9.4 Critical EPSS 1.3% KEV · Not listed
Vendors
Suse
Products
Rancher
CVE-2026-88810

Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRules

A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was not subject to the privilege-escalation validation applied to the other permission-carrying fields of a GlobalRole. As a result, a non-administrative user could be granted, through a global role  binding, permissions in downstream clusters that exceed the permissions that user already holds. This affected SUSE Rancher 2.15.2 only, and SUSE Rancher Webhook 0.11.0 up to 0.11.4, and 0.12.0 up to 0.12.1.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher
CVE-2026-88809

Rancher meta proxy allowlist bypass leading to server-side request forgery

A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to  destinations that appear on a configured allowlist. The allowlist decision was evaluated in a  place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher
CVE-2026-94290

Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller

SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher
CVE-2026-88811

Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher
CVE-2026-104623

Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster

A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher
CVE-2026-25703

Potential information leakage from manager /network/graph API in NeuVector

NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Neuvector
CVE-2026-44938

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace. An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher Rancher Fleet
CVE-2026-44948

Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler

A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher Rancher Fleet
CVE-2026-41050

Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher Rancher Fleet
CVE-2023-32198

Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Steve
CVE-2024-22031

Rancher users who can create Projects can gain access to arbitrary projects

A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher
CVE-2025-23390

Fleet doesn’t validate a server’s certificate when connecting through SSH

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Fleet