CVE-2021-25313

Rancher: XSS on /v3/cluster/

7.1 HighFix available

A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote attackers to execute JavaScript via malicious links. This issue affects: SUSE Rancher Rancher versions prior to 2.5.6.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: None

Exploit likelihood

1.50%Up 0.4 points since Apr 14, 2021

What each source reports

CVE List Score used 7.1

Rancher: XSS on /v3/cluster/

Record: CVE-2021-25313
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2022-2822 7.1

Record: EUVD-2022-2822
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6m8r-jh89-rq7h 6.1

Rancher Cross-site Scripting Vulnerability

Record: GHSA-6m8r-jh89-rq7h
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 7.1

Record: CVE-2021-25313
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

Record: CVE-2021-25313
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-6m8r-jh89-rq7h 6.1

Rancher Cross-site Scripting Vulnerability

Record: GHSA-6m8r-jh89-rq7h
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

suse rancher

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/rancher/rancher` Go	2.5.0 up to 2.5.6	2.5.6
`github.com/rancher/rancher` Go	2.4.0 up to 2.4.14	2.4.14
`github.com/rancher/rancher` Go	before 2.3.11	2.3.11

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-25313 is a high vulnerability (CVSS 7.1) in Suse Rancher, published March 5, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in github.com/rancher/rancher 2.5.6.