Skip to contentSuse Rancher vulnerabilities
- suse rancherRancher users who can create Projects can gain access to arbitrary projectsCVE-2024-22031Fix available8.5 High
- suse rancherRancher: Restricted Administrator can change Administrator's passwordsCVE-2025-23391Fix available9.1 Critical
- suse rancherRancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First LoginCVE-2025-23389Fix available8.4 High
- suse rancherUnauthenticated stack overflow in /v3-public/authproviders APICVE-2025-23388Fix available8.2 High
- suse rancherRancher's SAML-based login via CLI can be denied by unauthenticated usersCVE-2025-23387Fix available5.3 Medium
- suse rancherStored Cross-site Scripting vulnerability in Rancher UICVE-2024-52281Fix available8.9 High
- suse rancherRancher Helm Applications may have sensitive values leakedCVE-2024-52282Fix available6.2 Medium
- suse rancherUsers can issue watch commands for arbitrary resourcesCVE-2024-52280Fix available7.7 High
- suse rancherRancher Remote Code Execution via Cluster/Node DriversCVE-2024-22036Fix available9.1 Critical
- suse rancherExposure of vSphere's CPI and CSI credentials in RancherCVE-2022-45157Fix available8.5 High
- suse rancherRancher agents can be hijacked by taking over the Rancher Server URLCVE-2024-22030Fix available8.0 High
- suse rancherRancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpecCVE-2024-22032Fix available7.1 High
- suse rancherRancher's External RoleTemplates can lead to privilege escalationCVE-2023-32197Fix available7.5 High
- rancherRancher's External RoleTemplates can lead to privilege escalationCVE-2023-32196Fix available7.5 High
- suse rancherRancher does not automatically clean up a user deleted or disabled from the configured Authentication ProviderCVE-2023-22650Fix available8.7 High
- rancherRancher 'Audit Log' leaks sensitive informationCVE-2023-22649Fix available8.4 High
- rancherRancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'CVE-2023-32194Fix available8.6 High
- suse rke2, rancher rke2 +1 moreRKE2 supervisor port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attackCVE-2023-32186Fix available7.5 High
- suse rancherRancher users retain access after moving namespaces into projects they don't have access toCVE-2020-10676Fix available8.8 High
- suse rancherRancher UI has multiple Cross-Site Scripting (XSS) issuesCVE-2022-43760Fix available8.4 High
- suse rancherRancher vulnerable to Privilege Escalation via manipulation of SecretsCVE-2023-22647Fix available9.9 Critical
- suse rancherRancher's Azure AD permission changes are not reflected on active sessionsCVE-2023-22648Fix available8.0 High
- suse rancherRancher Webhook is misconfigured during upgrade processCVE-2023-22651Fix available9.9 Critical
- suse rancher, wrangler +1 more[RANCHER] OS command injection in Rancher and FleetCVE-2022-31249Fix available7.5 High
- suse rancher, wrangler +1 moreRancher/Wrangler: Denial of service when processing Git credentialsCVE-2022-43756Fix available5.9 Medium
- suse rancherRancher: Exposure of sensitive fieldsCVE-2022-43757Fix available9.9 Critical
- suse rancherRancher: Command injection in Git packageCVE-2022-43758Fix available7.6 High
- suse rancherAuthenticated user can gain unauthorized shell pod and kubectl access in the local clusterCVE-2022-21953Fix available7.4 High
- suse rancherRancher: Privilege escalation via promoted rolesCVE-2022-43759Fix available7.2 High
- suse rancherRancher: Non-random authentication tokenCVE-2022-43755Fix available7.1 High
- suse rancherRancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)CVE-2022-31247Fix available9.1 Critical
- suse rancherRancher: Failure to properly sanitize credentials in cluster template answersCVE-2021-36783Fix available9.9 Critical
- suse rancherRancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io objectCVE-2021-36782Public exploitFix available9.9 Critical
- suse rancherRancher: Weave CNI password is not set if RKE template is used with CNI value overriddenCVE-2022-21951Fix available6.8 Medium
- suse rancherWrite access to the Catalog for any user when restricted-admin role is enabledCVE-2021-4200Fix available5.4 Medium
- suse rancherPrivilege escalation for users with create/update permissions in Global RolesCVE-2021-36784Fix available7.2 High
- suse rancherExposure of repository credentials to external third-party sourcesCVE-2021-36778Fix available7.3 High
- rancherSteve API proxy impersonationCVE-2021-36776Fix available8.8 High
- rancherDeleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindingsCVE-2021-36775Fix available8.8 High
- suse rancher, rancher desktop +1 morerancher desktop: Dashboard API is network accessibleCVE-2022-219478.3 High
- suse rancher, rancher k3s, rancher rke2 +2 moreK3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a tokenCVE-2021-32001Fix available6.5 Medium
- rancher, rancher suse linux enterprise server 15, suse linux enterprise server 15 +2 moreRancher: Privilege escalation vulnerability via malicious Connection headerCVE-2021-31999Fix available8.8 High
- rancherRancher: Cloud credentials can be used through proxy API by users without accessCVE-2021-25320Fix available9.9 Critical
- rancherrancher: API group not properly specified when creating Kubernetes RBAC resourcesCVE-2021-25318Fix available8.8 High
- suse rancherRancher: XSS on /v3/cluster/CVE-2021-25313Fix available7.1 High
- suse rancherRancher Vulnerable to Cross-site Request Forgery (CSRF)CVE-2019-13209Fix available6.1 Medium
- suse rancherRancher Recreates Default User With Known Password Despite DeletionCVE-2019-11202Fix available9.8 Critical
- suse rancherRancher Login Parameter Can Be EditedCVE-2019-11881Public exploit4.7 Medium
- suse rancherRancher Privilege Escalation VulnerabilityCVE-2019-12274Fix available8.8 High
- suse rancherRancher code injection via fluentd config commandsCVE-2019-12303Fix available8.8 High
- Show moreLoading…