Rancher

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

Rancher records in CISA KEV

No Rancher vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Rancher 5 records MEDIUM

Records

7 records

TI-2021-07559 CVE-2021-25320 · GHSA-gqf8-rvrh-g7w6

Rancher: Cloud credentials can be used through proxy API by users without access

MEDIUM 44

A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credential ID.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00855 Published 2021-07-15 Fixed in 2.5.9, 2.4.16 CWE-284

TI-2026-32455 CVE-2026-44543 · GHSA-7fxv-8wr2-mfc4

Local Path Provisioner: HelperPod Template Injection

MEDIUM 40

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.0041 Published 2026-05-28 Fixed in 0.0.36 CWE-269

TI-2021-14897 CVE-2021-36776 · GHSA-gvh9-xgrq-r8hw

Steve API proxy impersonation

MEDIUM 40

A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01123 Published 2022-04-01 Fixed in 2.5.10 CWE-284

TI-2021-14896 CVE-2021-36775 · GHSA-28g7-896h-695v

Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings

MEDIUM 40

a Improper Access Control vulnerability in SUSE Rancher allows users to keep privileges that should have been revoked.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0097 Published 2022-04-01 Fixed in 2.4.18, 2.5.12 +1 CWE-284

TI-2021-11979 CVE-2021-31999 · GHSA-pvxj-25m6-7vqr

Rancher: Privilege escalation vulnerability via malicious Connection header

MEDIUM 40

A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01052 Published 2021-07-15 Fixed in 2.5.9, 2.4.16 CWE-807

TI-2021-07557 CVE-2021-25318 · GHSA-f9xf-jq4j-vqw4

rancher: API group not properly specified when creating Kubernetes RBAC resources

MEDIUM 40

A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01051 Published 2021-07-15 Fixed in 2.5.9, 2.4.16 CWE-732

TI-2026-40392 CVE-2026-55997

Long-lived Rancher registration token exposed in plaintext

LOW 39

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00112 Published 2026-08-05 Fixed in 2.14.4, 2.13.8 CWE-312

Open these records in search →