Read the docs
TI-2019-08380 Aliases CVE-2019-11202GHSA-xh8x-j8h3-m5ph

An issue was discovered that affects the following versions of Rancher: v2.0.0 through…

Priority MEDIUM 45CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.

Why it matters now

EPSS 0.01604 75th percentileScored 2026-11-07
Fix Fixed github.com/rancher/rancher (Go): 2.2.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/rancher/rancher (Go)2.0.0 – 2.0.13—No fix listedGHSA-xh8x-j8h3-m5ph
—github.com/rancher/rancher (Go)2.1.0 – 2.1.8—No fix listedGHSA-xh8x-j8h3-m5ph
—github.com/rancher/rancher (Go)2.2.0 to before 2.2.22.2.2Patch availableGHSA-xh8x-j8h3-m5ph
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/rancher/rancher (Go) Vendor— Affected 2.0.0 – 2.0.13 Fixed in — No fix listed GHSA-xh8x-j8h3-m5ph
  • github.com/rancher/rancher (Go) Vendor— Affected 2.1.0 – 2.1.8 Fixed in — No fix listed GHSA-xh8x-j8h3-m5ph
  • github.com/rancher/rancher (Go) Vendor— Affected 2.2.0 to before 2.2.2 Fixed in 2.2.2 Patch available GHSA-xh8x-j8h3-m5ph

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*2.0.0 – 2.0.13; 2.1.0 – 2.1.8; 2.2.0 – 2.2.1VulnerableSUSE
  • cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.0.13; 2.1.0 – 2.1.8; 2.2.0 – 2.2.1 Vulnerable ·SUSE

Remediation

  • Fix · GHSA-xh8x-j8h3-m5ph github.com/rancher/rancher (Go) Fixed in 2.2.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-11202
  2. 2026-10-03 Alias added: GHSA-xh8x-j8h3-m5ph

References

Advisory 4

Other 3

  • TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
  • TI-2022-21489 Rancher: Non-random authentication token CVSS 3.1CRITICAL 9.8
  • TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
  • TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
  • TI-2022-21491 Rancher: Exposure of sensitive fields CVSS 3.1CRITICAL 9.9
  • TI-2021-14904 Rancher: Failure to properly sanitize credentials in cluster template answers CVSS 3.1CRITICAL 9.9
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences