Read the docs
TI-2021-07559 Aliases CVE-2021-25320GHSA-gqf8-rvrh-g7w6

Rancher: Cloud credentials can be used through proxy API by users without access

Priority MEDIUM 44CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credential ID. Rancher in this case would attach the requested credentials without further checks This issue affects: Rancher versions prior to 2.5.9; Rancher versions prior to 2.4.16.

Why it matters now

EPSS 0.00855 58th percentileScored 2026-11-07
Fix Fixed Rancher (Rancher): 2.5.9, 2.4.16github.com/rancher/rancher (Go): 2.4.16, 2.5.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RancherRancherRancher to before 2.5.92.5.9Patch availableCNA
RancherRancherRancher to before 2.4.162.4.16Patch availableCNA
—github.com/rancher/rancher (Go)2.2.0 to before 2.4.162.4.16Patch availableGHSA-gqf8-rvrh-g7w6
—github.com/rancher/rancher (Go)2.5.0 to before 2.5.92.5.9Patch availableGHSA-gqf8-rvrh-g7w6
  • Rancher VendorRancher Affected Rancher to before 2.5.9 Fixed in 2.5.9 Patch available CNA
  • Rancher VendorRancher Affected Rancher to before 2.4.16 Fixed in 2.4.16 Patch available CNA
  • github.com/rancher/rancher (Go) Vendor— Affected 2.2.0 to before 2.4.16 Fixed in 2.4.16 Patch available GHSA-gqf8-rvrh-g7w6
  • github.com/rancher/rancher (Go) Vendor— Affected 2.5.0 to before 2.5.9 Fixed in 2.5.9 Patch available GHSA-gqf8-rvrh-g7w6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rancher:rancher:*:*:*:*:*:*:*:*before 2.4.16; 2.5.0 to before 2.5.9VulnerableRancher
  • cpe:2.3:a:rancher:rancher:*:*:*:*:*:*:*:* Versions before 2.4.16; 2.5.0 to before 2.5.9 Vulnerable ·Rancher

Remediation

  • Fix · CNA Rancher (Rancher) Fixed in 2.5.9
  • Fix · CNA Rancher (Rancher) Fixed in 2.4.16
  • Fix · GHSA-gqf8-rvrh-g7w6 github.com/rancher/rancher (Go) Fixed in 2.4.16 Advisory →
  • Fix · GHSA-gqf8-rvrh-g7w6 github.com/rancher/rancher (Go) Fixed in 2.5.9 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Rancher 2.5.9

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2021-11979 Rancher: Privilege escalation vulnerability via malicious Connection headerPriority MEDIUM 40
    • TI-2021-07557 rancher: API group not properly specified when creating Kubernetes RBAC resourcesPriority MEDIUM 40
    Show all 3 records →
  • Release ·

    Rancher 2.4.16

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2021-07557 rancher: API group not properly specified when creating Kubernetes RBAC resourcesPriority MEDIUM 40
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-25320
  2. 2026-10-03 Alias added: GHSA-gqf8-rvrh-g7w6

References

Advisory 2

Other 2

  • TI-2021-14897 Steve API proxy impersonation CVSS 3.1HIGH 8.8
  • TI-2021-14896 Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings CVSS 3.1HIGH 8.8
  • TI-2021-11979 Rancher: Privilege escalation vulnerability via malicious Connection header CVSS 3.1HIGH 8.8
  • TI-2021-07557 rancher: API group not properly specified when creating Kubernetes RBAC resources CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences