{"id":"CVE-2021-25318","aliases":["EUVD-2024-1195","GHSA-f9xf-jq4j-vqw4","GO-2024-2768"],"status":"published","title":"rancher: API group not properly specified when creating Kubernetes RBAC resources","description":"A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to. This issue affects: Rancher versions prior to 2.5.9 ; Rancher versions prior to 2.4.16.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01051,"percentile":0.6457,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2021-07-15T08:55:15Z","modified":"2026-10-24T10:30:43Z","fixes":[{"ecosystem":"Go","package":"github.com/rancher/rancher","fixed_in":["2.4.16","2.5.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/rancher/rancher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.16"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/rancher/rancher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rancher/rancher","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.4.16"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rancher/rancher","ranges":[{"type":"SEMVER","events":[{"introduced":"2.5.0"},{"fixed":"2.5.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rancher/rancher","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0+incompatible"}]}]}],"products":[{"vendor":"rancher","product":"rancher"},{"vendor":"suse","product":"rancher"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1184913","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25318","tags":["advisory"]},{"url":"https://github.com/rancher/rancher/issues/33590","tags":["web","report"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2768","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f9xf-jq4j-vqw4","tags":["advisory"]},{"url":"https://github.com/rancher/rancher","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-25318","title":"rancher: API group not properly specified when creating Kubernetes RBAC resources","description":"A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to. This issue affects: Rancher versions prior to 2.5.9 ; Rancher versions prior to 2.4.16.","status":"published","published":"2021-07-15T08:55:15.569Z","modified":"2024-09-16T20:37:30.651Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:32:59.802172Z"}],"euvd":[{"id":"EUVD-2024-1195","description":"A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to. This issue affects: Rancher versions prior to 2.5.9 ; Rancher versions prior to 2.4.16.","status":"published","published":"2021-07-15T08:55:15Z","modified":"2024-09-16T20:37:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:12.113193Z"}],"ghsa":[{"id":"GHSA-f9xf-jq4j-vqw4","title":"Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources","description":"A vulnerability was discovered in Rancher versions 2.0 through the aforementioned fixed versions, where users were granted access to resources regardless of the resource's API group. For example Rancher should have allowed users access to `apps.catalog.cattle.io`, but instead incorrectly gave access to `apps.*`. Resource affected include: \n\n**Downstream clusters:**\napiservices\nclusters\nclusterrepos\npersistentvolumes\nstorageclasses\n\n**Rancher management cluster**\napprevisions\napps\ncatalogtemplates\ncatalogtemplateversions\nclusteralertgroups\nclusteralertrules\nclustercatalogs\nclusterloggings\nclustermonitorgraphs\nclusterregistrationtokens\nclusterroletemplatebindings\nclusterscans\netcdbackups\nnodepools\nnodes\nnotifiers\npipelineexecutions\npipelines\npipelinesettings\npodsecuritypolicytemplateprojectbindings\nprojectalertgroups\nprojectalertrules\nprojectcatalogs\nprojectloggings\nprojectmonitorgraphs\nprojectroletemplatebindings\nprojects\nsecrets\nsourcecodeproviderconfigs\n\nThere is not a direct mitigation besides upgrading to the patched Rancher versions.","status":"published","published":"2024-04-24T21:02:01Z","modified":"2024-08-07T05:01:39Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:37:58.427757Z"}],"nvd":[{"id":"CVE-2021-25318","description":"A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to. This issue affects: Rancher versions prior to 2.5.9 ; Rancher versions prior to 2.4.16.","status":"published","published":"2021-07-15T09:15:07.777Z","modified":"2026-06-17T03:41:49.187Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:06:55.747384Z"}],"osv":[{"id":"CVE-2021-25318","description":"A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to. This issue affects: Rancher versions prior to 2.5.9 ; Rancher versions prior to 2.4.16.","status":"published","published":"2021-07-15T09:15:07.777Z","modified":"2026-10-24T10:30:43.256465274Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"GHSA-f9xf-jq4j-vqw4","title":"Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources","description":"A vulnerability was discovered in Rancher versions 2.0 through the aforementioned fixed versions, where users were granted access to resources regardless of the resource's API group. For example Rancher should have allowed users access to `apps.catalog.cattle.io`, but instead incorrectly gave access to `apps.*`. Resource affected include: \n\n**Downstream clusters:**\napiservices\nclusters\nclusterrepos\npersistentvolumes\nstorageclasses\n\n**Rancher management cluster**\napprevisions\napps\ncatalogtemplates\ncatalogtemplateversions\nclusteralertgroups\nclusteralertrules\nclustercatalogs\nclusterloggings\nclustermonitorgraphs\nclusterregistrationtokens\nclusterroletemplatebindings\nclusterscans\netcdbackups\nnodepools\nnodes\nnotifiers\npipelineexecutions\npipelines\npipelinesettings\npodsecuritypolicytemplateprojectbindings\nprojectalertgroups\nprojectalertrules\nprojectcatalogs\nprojectloggings\nprojectmonitorgraphs\nprojectroletemplatebindings\nprojects\nsecrets\nsourcecodeproviderconfigs\n\nThere is not a direct mitigation besides upgrading to the patched Rancher versions.","status":"published","published":"2024-04-24T21:02:01Z","modified":"2026-09-10T03:50:11.259878174Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"GO-2024-2768","title":"Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources in github.com/rancher/rancher","description":"Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources in github.com/rancher/rancher.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/rancher/rancher before v2.4.16, from v2.5.0 before v2.5.9.","status":"published","published":"2024-06-10T16:39:03Z","modified":"2026-07-10T13:44:30.433627131Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}