Read the docs
TI-2021-14904 Aliases CVE-2021-36783GHSA-8w87-58w6-hfv8

Rancher: Failure to properly sanitize credentials in cluster template answers

Priority MEDIUM 44CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-522.

Summary

A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, passwords and API tokens that have been stored in cleartext and exposed via API endpoints. This issue affects: SUSE Rancher Rancher versions prior to 2.6.4; Rancher versions prior to 2.5.13.

Why it matters now

EPSS 0.00796 56th percentileScored 2026-11-07
Fix Fixed Rancher (SUSE): 2.6.4, 2.5.13github.com/rancher/rancher (Go): 2.5.13, 2.6.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSERancherRancher to before 2.6.42.6.4Patch availableCNA
SUSERancherRancher to before 2.5.132.5.13Patch availableCNA
—github.com/rancher/rancher (Go)2.5.0 to before 2.5.132.5.13Patch availableGHSA-8w87-58w6-hfv8
—github.com/rancher/rancher (Go)2.6.0 to before 2.6.42.6.4Patch availableGHSA-8w87-58w6-hfv8
  • Rancher VendorSUSE Affected Rancher to before 2.6.4 Fixed in 2.6.4 Patch available CNA
  • Rancher VendorSUSE Affected Rancher to before 2.5.13 Fixed in 2.5.13 Patch available CNA
  • github.com/rancher/rancher (Go) Vendor— Affected 2.5.0 to before 2.5.13 Fixed in 2.5.13 Patch available GHSA-8w87-58w6-hfv8
  • github.com/rancher/rancher (Go) Vendor— Affected 2.6.0 to before 2.6.4 Fixed in 2.6.4 Patch available GHSA-8w87-58w6-hfv8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*2.5.0 to before 2.5.13; 2.6.0 to before 2.6.4VulnerableSUSE
  • cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.5.13; 2.6.0 to before 2.6.4 Vulnerable ·SUSE

Remediation

  • Fix · CNA Rancher (SUSE) Fixed in 2.6.4
  • Fix · CNA Rancher (SUSE) Fixed in 2.5.13
  • Fix · GHSA-8w87-58w6-hfv8 github.com/rancher/rancher (Go) Fixed in 2.5.13 Advisory →
  • Fix · GHSA-8w87-58w6-hfv8 github.com/rancher/rancher (Go) Fixed in 2.6.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-36783
  2. 2026-10-03 Alias added: GHSA-8w87-58w6-hfv8

References

Advisory 3

Other 1

  • TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
  • TI-2022-21489 Rancher: Non-random authentication token CVSS 3.1CRITICAL 9.8
  • TI-2019-08380 An issue was discovered that affects the following versions of Rancher: v2.0.0 through… CVSS 3.0CRITICAL 9.8
  • TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
  • TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
  • TI-2022-21491 Rancher: Exposure of sensitive fields CVSS 3.1CRITICAL 9.9
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences