Read the docs
TI-2021-11979 Aliases CVE-2021-31999GHSA-pvxj-25m6-7vqr

Rancher: Privilege escalation vulnerability via malicious Connection header

Priority MEDIUM 40CWE-807Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16.

Why it matters now

EPSS 0.01052 64th percentileScored 2026-11-07
Fix Fixed Rancher (Rancher): 2.5.9SUSE Linux Enterprise Server 15 (Rancher): 2.4.16+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RancherRancherRancher to before 2.5.92.5.9Patch availableCNA
RancherSUSE Linux Enterprise Server 15Rancher to before 2.4.162.4.16Patch availableCNA
—github.com/rancher/rancher (Go)2.0.0 to before 2.4.162.4.16Patch availableGHSA-pvxj-25m6-7vqr
—github.com/rancher/rancher (Go)2.5.0 to before 2.5.92.5.9Patch availableGHSA-pvxj-25m6-7vqr
  • Rancher VendorRancher Affected Rancher to before 2.5.9 Fixed in 2.5.9 Patch available CNA
  • SUSE Linux Enterprise Server 15 VendorRancher Affected Rancher to before 2.4.16 Fixed in 2.4.16 Patch available CNA
  • github.com/rancher/rancher (Go) Vendor— Affected 2.0.0 to before 2.4.16 Fixed in 2.4.16 Patch available GHSA-pvxj-25m6-7vqr
  • github.com/rancher/rancher (Go) Vendor— Affected 2.5.0 to before 2.5.9 Fixed in 2.5.9 Patch available GHSA-pvxj-25m6-7vqr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rancher:rancher:*:*:*:*:*:*:*:*before 2.4.16; 2.5.0 to before 2.5.9VulnerableRancher
  • cpe:2.3:a:rancher:rancher:*:*:*:*:*:*:*:* Versions before 2.4.16; 2.5.0 to before 2.5.9 Vulnerable ·Rancher

Remediation

  • Fix · CNA Rancher (Rancher) Fixed in 2.5.9
  • Fix · CNA SUSE Linux Enterprise Server 15 (Rancher) Fixed in 2.4.16
  • Fix · GHSA-pvxj-25m6-7vqr github.com/rancher/rancher (Go) Fixed in 2.4.16 Advisory →
  • Fix · GHSA-pvxj-25m6-7vqr github.com/rancher/rancher (Go) Fixed in 2.5.9 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Rancher 2.5.9

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2021-07559 Rancher: Cloud credentials can be used through proxy API by users without accessPriority MEDIUM 44
    • TI-2021-07557 rancher: API group not properly specified when creating Kubernetes RBAC resourcesPriority MEDIUM 40
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-31999
  2. 2026-10-03 Alias added: GHSA-pvxj-25m6-7vqr

References

Advisory 2

Other 2

  • TI-2021-07559 Rancher: Cloud credentials can be used through proxy API by users without access CVSS 3.1CRITICAL 9.9
  • TI-2021-14897 Steve API proxy impersonation CVSS 3.1HIGH 8.8
  • TI-2021-14896 Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings CVSS 3.1HIGH 8.8
  • TI-2021-07557 rancher: API group not properly specified when creating Kubernetes RBAC resources CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences