In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update…
Priority LOW 37CWE-269Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269.
Summary
In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they have been removed from it.
Why it matters now
EPSS 0.01028 63rd percentileScored 2026-11-07
Fix Fixed github.com/rancher/rancher (Go): 2.1.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | github.com/rancher/rancher (Go) | 2.0.0 to before 2.1.6 | 2.1.6 | Patch available | GHSA-6r7x-4q7g-h83j |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/rancher/rancher (Go) Vendor— Affected 2.0.0 to before 2.1.6 Fixed in 2.1.6 Patch available GHSA-6r7x-4q7g-h83j
Remediation
- Fix · GHSA-6r7x-4q7g-h83j github.com/rancher/rancher (Go) Fixed in 2.1.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-6287
- 2026-10-03 Alias added: GHSA-6r7x-4q7g-h83j
References
Advisory 3
Other 6
- https://github.com/rancher/rancher/issues/17244
- https://github.com/rancher/rancher/issues/17724
- https://forums.rancher.com/t/rancher-release-v2-1-6/13148
- https://forums.rancher.com/t/rancher-security-announcement-cve-2018-20321-and-cve-2019-6287/13149
- https://github.com/rancher/rancher
- https://rancher.com/blog/2019/2019-01-29-explaining-security-vulnerabilities-addressed-in-rancher-v2-1-6-and-v2-0-11
More SUSE Rancher vulnerabilities
- TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
- TI-2022-21489 Rancher: Non-random authentication token CVSS 3.1CRITICAL 9.8
- TI-2019-08380 An issue was discovered that affects the following versions of Rancher: v2.0.0 through… CVSS 3.0CRITICAL 9.8
- TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
- TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
- TI-2022-21491 Rancher: Exposure of sensitive fields CVSS 3.1CRITICAL 9.9
Sources
- CVE-2019-6287 · CVE Program
- CVE-2019-6287 · NVD
- FIRST EPSS
- GHSA-6r7x-4q7g-h83j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences