Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16

Export CSV
CVE-2026-55997

Long-lived Rancher registration token exposed in plaintext

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Rancher
Products
Rancher
CVE-2026-44543

Local Path Provisioner: HelperPod Template Injection

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by rancher/local-path-provisioner. The helperPod.yaml template is loaded by the provisioner and used to create HelperPods during PVC provisioning and cleanup operations. However, the template is not sufficiently validated before use. Security-sensitive fields such as securityContext.privileged, hostPath volumes, and Linux capabilities can be injected into the template. When a PVC operation triggers HelperPod creation, the provisioner creates the HelperPod using the attacker-controlled template. This can result in a privileged pod running on the target node with the host root filesystem mounted. This may allow the attacker to access sensitive host files, read ServiceAccount tokens from other pods on the same node, access other tenants' local-path volume data, or modify files on the host node. This vulnerability is fixed in 0.0.36.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Rancher Suse
Products
Local-path-provisioner Local Path Provisioner
CVE-2023-32194

Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'

A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will receive * permissions for core namespaces. This can lead to someone being capable of accessing, creating, updating, or deleting a namespace in the project.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Rancher
Products
Rancher
CVE-2023-32193

Norman API Cross-site Scripting Vulnerability

A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Rancher
Products
Norman
CVE-2023-32196

Rancher's External RoleTemplates can lead to privilege escalation

A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific scenarios can lead to privilege escalation.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Rancher
Products
Rancher
CVE-2024-22036

Rancher Remote Code Execution via Cluster/Node Drivers

A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root access to the Rancher container itself. In production environments, further privilege escalation is possible based on living off the land within the Rancher container itself. For the test and development environments, based on a –privileged Docker container, it is possible to escape the Docker container and gain execution access on the host system. This issue affects rancher: from 2.7.0 before 2.7.16, from 2.8.0 before 2.8.9, from 2.9.0 before 2.9.3.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Rancher
Products
Rancher
CVE-2024-58260

Rancher update on users can deny the service to the admin

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Rancher Suse
Products
Rancher Rancher
CVE-2024-58267

Rancher CLI SAML authentication is vulnerable to phishing attacks

A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phishing attacks. The custom authentication protocol for SAML-based providers can be abused to steal Rancher’s authentication tokens.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Rancher Suse
Products
Rancher Rancher
CVE-2025-54468

Rancher sends sensitive information to external services through the `/meta/proxy` endpoint

A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Rancher Suse
Products
Rancher Rancher
CVE-2022-45157

Exposure of vSphere's CPI and CSI credentials in Rancher

A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Rancher
Products
Rancher
CVE-2021-36776

Steve API proxy impersonation

A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users. This issue affects: SUSE Rancher Rancher versions prior to 2.5.10.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Rancher
Products
Rancher
CVE-2021-36775

Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings

a Improper Access Control vulnerability in SUSE Rancher allows users to keep privileges that should have been revoked. This issue affects: SUSE Rancher Rancher versions prior to 2.4.18; Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Rancher
Products
Rancher
CVE-2021-31999

Rancher: Privilege escalation vulnerability via malicious Connection header

A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Rancher
Products
Rancher
CVE-2021-25320

Rancher: Cloud credentials can be used through proxy API by users without access

A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credential ID. Rancher in this case would attach the requested credentials without further checks This issue affects: Rancher versions prior to 2.5.9; Rancher versions prior to 2.4.16.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Rancher
Products
Rancher
CVE-2021-25318

rancher: API group not properly specified when creating Kubernetes RBAC resources

A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to. This issue affects: Rancher versions prior to 2.5.9 ; Rancher versions prior to 2.4.16.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Rancher
Products
Rancher
CVE-2023-22649

Rancher 'Audit Log' leaks sensitive information

A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only deployments that have it enabled and have [AUDIT_LEVEL](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels) set to `1 or above` are impacted by this issue.

CVSS 4.0 · 8.4 High EPSS 2.0% KEV · Not listed
Vendors
Rancher Suse
Products
Rancher Rancher