Github.Com Rancher Rancher vulnerabilities

CVE-2021-36782 [CRITICAL] CWE-312 Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials ### Impact An issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where sensitive fields, like passwords, API keys and Rancher's service account token (used to provision clusters), were stored in plaintext directly

CVE-2023-22649 [HIGH] CWE-532 Rancher 'Audit Log' leaks sensitive information Rancher 'Audit Log' leaks sensitive information ### Impact A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only deployments that have it enabled and have [AUDIT_LEVEL](https://ranchermanager.docs.rancher.com/how-to-g

CVE-2026-44939 [CRITICAL] CWE-95 Rancher vulnerable to command injection through unsanitized YAML parameter Rancher vulnerable to command injection through unsanitized YAML parameter ### Impact A critical command injection vulnerability has been identified in the Rancher Manager cluster import endpoint `/v3/import/{token}_{clusterId}.yaml` through unsanitized YAML parameters. This endpoint accepts an `authImage` query parameter that is rendered without sanitization into a generated Kubernetes m

CVE-2022-43755 [CRITICAL] CWE-330 Rancher cattle-token is predictable Rancher cattle-token is predictable ### Impact An issue was discovered in Rancher versions up to and including 2.6.9 and 2.7.0, where the `cattle-token` secret, used by the `cattle-cluster-agent`, is predictable. Even after the token is regenerated, it will have the same value. This issue is not present in Rancher 2.5 releases. The `cattle-token` is used by Rancher's `cattle-cluster-agent` to connect to the Kubernetes API o

CVE-2021-36783 [CRITICAL] CWE-200 Rancher doesn't properly sanitize credentials in cluster template answers Rancher doesn't properly sanitize credentials in cluster template answers ### Impact It was discovered that in Rancher versions up to and including 2.5.12 and 2.6.3 there is a failure to properly sanitize credentials in cluster template answers. This failure can lead to plaintext storage and exposure of credentials, passwords and API tokens. The exposed credentials are visible in Ranche

CVE-2026-41053 [HIGH] CWE-303 Rancher has over-inclusive team membership expansion in GitHub App authentication provider Rancher has over-inclusive team membership expansion in GitHub App authentication provider ### Impact A vulnerability has been identified within Rancher Manager in the GitHub App authentication provider. When evaluating permissions, the provider incorrectly expands user team memberships to include all teams within the associated GitHub organization, rather than restricting ac

CVE-2019-11202 [CRITICAL] CWE-287 Rancher Recreates Default User With Known Password Despite Deletion Rancher Recreates Default User With Known Password Despite Deletion An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default adm

CVE-2021-25320 [CRITICAL] CWE-284 Rancher cloud credentials can be used through proxy API by users without access Rancher cloud credentials can be used through proxy API by users without access A vulnerability was discovered in Rancher 2.2.0 through the aforementioned patched versions, where cloud credentials weren't being properly validated through the Rancher API. Specifically through a proxy designed to communicate with cloud providers. Any Rancher user that was logged-in and aware of a clou

CVE-2023-22651 [CRITICAL] CWE-269 Rancher Webhook is misconfigured during upgrade process Rancher Webhook is misconfigured during upgrade process ### Impact A failure in the update logic of Rancher's admission Webhook may lead to the misconfiguration of the Webhook. This component enforces validation rules and security checks before resources are admitted into the Kubernetes cluster. When the Webhook is operating in a degraded state, it no longer validates any resources, which may result in s

CVE-2018-20321 [MEDIUM] CWE-288 Access Control Bypass Access Control Bypass An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a pod, and then use that pod to execute administrative privileged commands against the k8s cluster. This could be mitigated by isolating the default namespace in a separate project, where only cluster admins can be given permissions to access. As of 2018-12-20, this b

CVE-2022-43757 [CRITICAL] CWE-200 Plaintext storage of sensitive data in Rancher API and cluster.management.cattle.io objects Plaintext storage of sensitive data in Rancher API and cluster.management.cattle.io objects ### Impact This issue affects Rancher versions from 2.5.0 up to and including 2.5.16, from 2.6.0 up to and including 2.6.9 and 2.7.0. It was discovered that the security advisory CVE-2021-36782 (GHSA-g7j7-h4q8-8w2f), previously released by Rancher, missed addressing some sensitiv

CVE-2019-12303 [HIGH] CWE-74 Rancher code injection via fluentd config commands Rancher code injection via fluentd config commands In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.

CVE-2024-22036 [CRITICAL] CWE-269 Rancher Remote Code Execution via Cluster/Node Drivers Rancher Remote Code Execution via Cluster/Node Drivers ### Impact A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the `chroot` jail and gain root access to the Rancher container itself. In production environments, further privilege escalation is possible based on living off the land within the Rancher container itself. For the test and development envi

CVE-2023-22650 [HIGH] CWE-287 Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider ### Impact A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher

CVE-2025-23391 [CRITICAL] CWE-266 Rancher: Restricted Administrator can change Administrator's passwords Rancher: Restricted Administrator can change Administrator's passwords ### Impact A vulnerability has been identified within Rancher where a Restricted Administrator can change the password of Administrators and take over their accounts. A Restricted Administrator should be not allowed to change the password of more privileged users unless it contains the Manage Users permissions. Rancher

CVE-2026-41052 [CRITICAL] CWE-305 Rancher has Privilege Escalation from Project Owner to Host Rancher has Privilege Escalation from Project Owner to Host ### Impact A vulnerability has been identified in Rancher Manager that allows users assigned the Project Owner role to modify Pod Security Admission (PSA) labels on namespaces within their projects. Under the default role configuration, an attacker with the following access pattern can exploit this issue: 1. **Cluster Access:** The user is gr

CVE-2021-36776 [HIGH] CWE-284 Rancher's Steve API Component Improper authorization check allows privilege escalation Rancher's Steve API Component Improper authorization check allows privilege escalation ### Impact A flaw discovered in Rancher versions from 2.5.0 up to and including 2.5.9 allows an authenticated user to impersonate any user on a cluster through the Steve API proxy, without requiring knowledge of the impersonated user's credentials. This is due to the Steve API proxy not droppi

CVE-2022-43759 [HIGH] CWE-269 Privilege escalation in project role template binding (PRTB) and -promoted roles Privilege escalation in project role template binding (PRTB) and -promoted roles ### Impact An issue was discovered in Rancher versions from 2.5.0 up to and including 2.5.16 and from 2.6.0 up to and including 2.6.9, where an authorization logic flaw allows privilege escalation via project role template binding (PRTB) and `-promoted` roles. This issue is not present in Rancher 2.7 rele

CVE-2022-21953 [HIGH] CWE-284 Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster ### Impact An issue was discovered in Rancher where an authorization logic flaw allows an authenticated user on any downstream cluster to (1) open a shell pod in the Rancher `local` cluster and (2) have limited `kubectl` access to it. The expected behavior is that a user does not have

CVE-2021-25318 [HIGH] CWE-732 Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources A vulnerability was discovered in Rancher versions 2.0 through the aforementioned fixed versions, where users were granted access to resources regardless of the resource's API group. For example Rancher should have allowed users access to `apps.catalog.cattle.io`, but instead incorrectly gave access to