Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that…
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting, Tampering
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79 and CWE-352.
Summary
Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the cluster's Kubernetes API with the permissions and identity of the victim.
Why it matters now
EPSS 0.01099 65th percentileScored 2026-11-07
Fix Fixed github.com/rancher/rancher (Go): 2.0.16, 2.1.11, 2.2.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | github.com/rancher/rancher (Go) | 2.0.0 to before 2.0.16 | 2.0.16 | Patch available | GHSA-xhg2-rvm8-w2jh |
| — | github.com/rancher/rancher (Go) | 2.1.0 to before 2.1.11 | 2.1.11 | Patch available | GHSA-xhg2-rvm8-w2jh |
| — | github.com/rancher/rancher (Go) | 2.2.0 to before 2.2.5 | 2.2.5 | Patch available | GHSA-xhg2-rvm8-w2jh |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/rancher/rancher (Go) Vendor— Affected 2.0.0 to before 2.0.16 Fixed in 2.0.16 Patch available GHSA-xhg2-rvm8-w2jh
- github.com/rancher/rancher (Go) Vendor— Affected 2.1.0 to before 2.1.11 Fixed in 2.1.11 Patch available GHSA-xhg2-rvm8-w2jh
- github.com/rancher/rancher (Go) Vendor— Affected 2.2.0 to before 2.2.5 Fixed in 2.2.5 Patch available GHSA-xhg2-rvm8-w2jh
Remediation
- Fix · GHSA-xhg2-rvm8-w2jh github.com/rancher/rancher (Go) Fixed in 2.0.16 Advisory →
- Fix · GHSA-xhg2-rvm8-w2jh github.com/rancher/rancher (Go) Fixed in 2.1.11 Advisory →
- Fix · GHSA-xhg2-rvm8-w2jh github.com/rancher/rancher (Go) Fixed in 2.2.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-13209
- 2026-10-03 Alias added: GHSA-xhg2-rvm8-w2jh
References
Advisory 3
More SUSE Rancher vulnerabilities
- TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
- TI-2022-21489 Rancher: Non-random authentication token CVSS 3.1CRITICAL 9.8
- TI-2019-08380 An issue was discovered that affects the following versions of Rancher: v2.0.0 through… CVSS 3.0CRITICAL 9.8
- TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
- TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
- TI-2022-21491 Rancher: Exposure of sensitive fields CVSS 3.1CRITICAL 9.9
Sources
- CVE-2019-13209 · CVE Program
- CVE-2019-13209 · NVD
- FIRST EPSS
- GHSA-xhg2-rvm8-w2jh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences