CVE-2022-21951
published 2022-05-25CVE-2022-21951: A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to…
PriorityP336medium6.8CVSS 3.1
AVNACHPRLUINSUCHIHAN
EPSS
0.37%
28.7th percentile
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption of data transmitted via the network when a cluster is created from an RKE template with the CNI value overridden This issue affects: SUSE Rancher Rancher versions prior to 2.5.14; Rancher versions prior to 2.6.5.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | rancher_rancher | >= 2.5.0 < 2.5.14 | 2.5.14 |
| github.com | rancher_rancher | >= 2.6.0 < 2.6.5 | 2.6.5 |
| suse | rancher | >= 2.5.0 < 2.5.14 | 2.5.14 |
| suse | rancher | >= 2.6.0 < 2.6.5 | 2.6.5 |
| suse | rancher | >= Rancher < 2.5.14 | 2.5.14 |
| suse | rancher | >= Rancher < 2.6.5 | 2.6.5 |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv2.03.6LOWAV:N/AC:H/Au:S/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Rancher's weave CNI password is not configured when a cluster is created from an RKE template
ghsa·2026-03-03
CVE-2022-21951 [MEDIUM] CWE-311 Rancher's weave CNI password is not configured when a cluster is created from an RKE template
Rancher's weave CNI password is not configured when a cluster is created from an RKE template
### Impact
This vulnerability only affects customers using [Weave](https://rancher.com/docs/rancher/v2.6/en/faq/networking/cni-providers/#weave) CNI (Container Network Interface) when configured through [RKE templates](https://rancher.com/docs/rancher/v2.6/en/admin-settings/rke-templates/).
A flaw was discovered in Rancher versions from 2.5.0 up to and including 2.5.13 and from 2.6.0 up to and including 2.6.4, where a UI (user interface) issue with RKE templates does not include a value for the Weave password when Weave is chosen as the CNI.
If a cluster is created based on the mentioned template and Weave is configured as the CNI, no password will be created for [network encryption](https://w
OSV
Rancher's weave CNI password is not configured when a cluster is created from an RKE template
osv·2026-03-03
CVE-2022-21951 [MEDIUM] Rancher's weave CNI password is not configured when a cluster is created from an RKE template
Rancher's weave CNI password is not configured when a cluster is created from an RKE template
### Impact
This vulnerability only affects customers using [Weave](https://rancher.com/docs/rancher/v2.6/en/faq/networking/cni-providers/#weave) CNI (Container Network Interface) when configured through [RKE templates](https://rancher.com/docs/rancher/v2.6/en/admin-settings/rke-templates/).
A flaw was discovered in Rancher versions from 2.5.0 up to and including 2.5.13 and from 2.6.0 up to and including 2.6.4, where a UI (user interface) issue with RKE templates does not include a value for the Weave password when Weave is chosen as the CNI.
If a cluster is created based on the mentioned template and Weave is configured as the CNI, no password will be created for [network encryption](https://w
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-05-25
Published