CVE-2021-36783
published 2022-09-07CVE-2021-36783: A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members…
PriorityP260critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
0.65%
46.4th percentile
A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, passwords and API tokens that have been stored in cleartext and exposed via API endpoints. This issue affects: SUSE Rancher Rancher versions prior to 2.6.4; Rancher versions prior to 2.5.13.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | rancher_rancher | >= 2.5.0 < 2.5.13 | 2.5.13 |
| github.com | rancher_rancher | >= 2.6.0 < 2.6.4 | 2.6.4 |
| suse | rancher | >= 2.5.0 < 2.5.13 | 2.5.13 |
| suse | rancher | >= 2.6.0 < 2.6.4 | 2.6.4 |
| suse | rancher | >= Rancher < 2.6.4 | 2.6.4 |
| suse | rancher | >= Rancher < 2.5.13 | 2.5.13 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Rancher doesn't properly sanitize credentials in cluster template answers
osv·2026-03-03
CVE-2021-36783 [CRITICAL] Rancher doesn't properly sanitize credentials in cluster template answers
Rancher doesn't properly sanitize credentials in cluster template answers
### Impact
It was discovered that in Rancher versions up to and including 2.5.12 and 2.6.3 there is a failure to properly sanitize credentials in cluster template answers. This failure can lead to plaintext storage and exposure of credentials, passwords and API tokens.
The exposed credentials are visible in Rancher to authenticated `Cluster Owners`, `Cluster Members`, `Project Owners` and `Project Members` on the endpoints `/v1/management.cattle.io.clusters`, `/v3/clusters` and `/k8s/clusters/local/apis/management.cattle.io/v3/clusters`.
Sensitive fields are now stripped from `Clusters` objects before the object is stored. For objects that existed before this security fix, a one-time migration happens on startup.
GHSA
Rancher doesn't properly sanitize credentials in cluster template answers
ghsa·2026-03-03
CVE-2021-36783 [CRITICAL] CWE-200 Rancher doesn't properly sanitize credentials in cluster template answers
Rancher doesn't properly sanitize credentials in cluster template answers
### Impact
It was discovered that in Rancher versions up to and including 2.5.12 and 2.6.3 there is a failure to properly sanitize credentials in cluster template answers. This failure can lead to plaintext storage and exposure of credentials, passwords and API tokens.
The exposed credentials are visible in Rancher to authenticated `Cluster Owners`, `Cluster Members`, `Project Owners` and `Project Members` on the endpoints `/v1/management.cattle.io.clusters`, `/v3/clusters` and `/k8s/clusters/local/apis/management.cattle.io/v3/clusters`.
Sensitive fields are now stripped from `Clusters` objects before the object is stored. For objects that existed before this security fix, a one-time migration happens on startup.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-09-07
Published