Github.Com Rancher Rancher vulnerabilities

CVE-2020-10676 [HIGH] CWE-863 Rancher users retain access after moving namespaces into projects they don't have access to Rancher users retain access after moving namespaces into projects they don't have access to ### Impact A vulnerability was identified in which users with update privileges on a namespace, can move that namespace into a project they don't have access to. After the namespace transfer is completed, their previous permissions are still preserved, which enables them to gain acces

CVE-2021-36775 [HIGH] CWE-284 Rancher's Failure to delete orphaned role bindings does not revoke project level access from group based authentication Rancher's Failure to delete orphaned role bindings does not revoke project level access from group based authentication ### Impact This vulnerability only affects customers using group based authentication in Rancher versions up to and including 2.4.17, 2.5.11 and 2.6.2. When removing a Project Role associated to a group from a project, the bindi

CVE-2025-23389 [HIGH] CWE-284 Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login ### Impact A vulnerability in Rancher has been discovered, leading to a local user impersonation through SAML Authentication on first login. The issue occurs when a SAML authentication provider (AP) is configured (e.g. Keycloak). A ne

CVE-2022-45157 [HIGH] CWE-522 Exposure of vSphere's CPI and CSI credentials in Rancher Exposure of vSphere's CPI and CSI credentials in Rancher ### Impact A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability i

CVE-2021-31999 [HIGH] CWE-807 Rancher Privilege escalation vulnerability via malicious "Connection" header Rancher Privilege escalation vulnerability via malicious "Connection" header A vulnerability was discovered in Rancher 2.0.0 through the aforementioned patched versions, where a malicious Rancher user could craft an API request directed at the proxy for the Kubernetes API of a managed cluster to gain access to information they do not have access to. This is done by passing the "Impersonate

CVE-2023-22648 [HIGH] CWE-269 Rancher's Azure AD permission changes are not reflected on active sessions Rancher's Azure AD permission changes are not reflected on active sessions A bug has been identified in which permission changes in Azure AD are not reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group

CVE-2017-7297 [HIGH] Rancher Access Control Vulnerability Rancher Access Control Vulnerability Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. This is fixed in versions rancher/server:v1.2.4, rancher/server:v1.3.5, rancher/server:v1.4.3, and rancher/server:v1.5.3.

CVE-2024-58267 [HIGH] CWE-345 Rancher CLI SAML authentication is vulnerable to phishing attacks Rancher CLI SAML authentication is vulnerable to phishing attacks ### Impact A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phishing attacks. The custom authentication protocol for SAML-based providers can be abused to steal Rancher’s authentication tokens. Rancher Manager deployments without SAML authentication

CVE-2019-12274 [HIGH] CWE-668 Rancher Privilege Escalation Vulnerability Rancher Privilege Escalation Vulnerability In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.

CVE-2025-23388 [HIGH] CWE-121 Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API ### Impact An unauthenticated stack overflow crash, leading to a denial of service (DoS), was identified in Rancher’s `/v3-public/authproviders` public API endpoint. A malicious user could submit data to the API which would cause the Rancher server to crash, but no malicious or incorrect data would actuall

CVE-2024-58259 [HIGH] CWE-770 Rancher affected by unauthenticated Denial of Service Rancher affected by unauthenticated Denial of Service ### Impact A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing. This could result in: - Denial

CVE-2022-31247 [CRITICAL] CWE-285 Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB) Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB) ### Impact An issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where a flaw with authorization logic allows privilege escalation through cluster role template binding (CRTB) and project role template binding

CVE-2026-25705 [HIGH] CWE-35 Rancher Extensions have arbitrary file access via path traversal Rancher Extensions have arbitrary file access via path traversal ### Impact A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that t

CVE-2021-36778 [HIGH] CWE-200 Exposure of repository credentials to external third-party sources in Rancher Exposure of repository credentials to external third-party sources in Rancher ### Impact This issue only happens when the user configures access credentials to a private repository in Rancher inside `Apps & Marketplace > Repositories`. It affects Rancher versions 2.5.0 up to and including 2.5.11 and from 2.6.0 up to and including 2.6.2. An insufficient check of the same-origin policy whe

CVE-2023-22647 [CRITICAL] CWE-267 Rancher vulnerable to Privilege Escalation via manipulation of Secrets Rancher vulnerable to Privilege Escalation via manipulation of Secrets ### Impact A vulnerability has been identified which enables [Standard users](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions) or above to elevate their permissions to Administrator in the `l

CVE-2024-22030 [HIGH] CWE-295 Rancher agents can be hijacked by taking over the Rancher Server URL Rancher agents can be hijacked by taking over the Rancher Server URL ### Impact A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability. The targeted domain is the

CVE-2024-52281 [HIGH] CWE-79 Rancher UI has Stored Cross-site Scripting vulnerability Rancher UI has Stored Cross-site Scripting vulnerability ### Impact A vulnerability has been identified within Rancher UI that allows a malicious actor to perform a Stored XSS attack through the cluster description field. Please consult the associated [MITRE ATT&CK - Technique - Drive-by Compromise](https://attack.mitre.org/techniques/T1189/) for further information about this category of attack. ### Patches

CVE-2023-32194 [HIGH] CWE-269 Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' ### Impact A vulnerability has been identified when granting a `create` or `*` **global role** for a resource type of "namespaces"; no matter the API group, the subject will receive `*` permissions for core namespaces. This can lead to someone being capable of ac

CVE-2021-36784 [MEDIUM] CWE-269 Privilege escalation for users with create/update permissions in Global Roles in Rancher Privilege escalation for users with create/update permissions in Global Roles in Rancher ### Impact This vulnerability affects customers who utilize non-admin users that are able to create or edit [Global Roles](https://rancher.com/docs/rancher/v2.6/en/admin-settings/rbac/). The most common use case for this scenario is the [`restricted-admin`](https://rancher.com/docs/ranche

CVE-2024-58260 [HIGH] CWE-863 Rancher update on users can deny the service to the admin Rancher update on users can deny the service to the admin ### Impact A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts. Specifically: - Username takeover: A user with permission to update another user’s resource c