TI-2022-06315 Aliases CVE-2022-21953 GHSA-g25r-gvq3-wrq7

Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster

LOW 38CWE-862Published 2023-02-07 · Updated 2025-03-25

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0047 40th percentileScored 2026-11-07

Fix Fixed Rancher (SUSE): 2.5.17github.com/rancher/rancher (Go): 2.5.17, 2.6.10, 2.7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SUSE	Rancher	Rancher to before 2.5.17	2.5.17	Patch available	CNA
—	github.com/rancher/rancher (Go)	2.5.0 to before 2.5.17	2.5.17	Patch available	GHSA-g25r-gvq3-wrq7
—	github.com/rancher/rancher (Go)	2.6.0 to before 2.6.10	2.6.10	Patch available	GHSA-g25r-gvq3-wrq7
—	github.com/rancher/rancher (Go)	2.7.0 to before 2.7.1	2.7.1	Patch available	GHSA-g25r-gvq3-wrq7

Rancher VendorSUSE Affected Rancher to before 2.5.17 Fixed in 2.5.17 Patch available CNA
github.com/rancher/rancher (Go) Vendor— Affected 2.5.0 to before 2.5.17 Fixed in 2.5.17 Patch available GHSA-g25r-gvq3-wrq7
github.com/rancher/rancher (Go) Vendor— Affected 2.6.0 to before 2.6.10 Fixed in 2.6.10 Patch available GHSA-g25r-gvq3-wrq7
github.com/rancher/rancher (Go) Vendor— Affected 2.7.0 to before 2.7.1 Fixed in 2.7.1 Patch available GHSA-g25r-gvq3-wrq7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:suse:rancher::::::::	2.5.0 to before 2.5.17; 2.6.0 to before 2.6.10; 2.7.0 to before 2.7.1	Vulnerable	SUSE

cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.5.17; 2.6.0 to before 2.6.10; 2.7.0 to before 2.7.1 Vulnerable ·SUSE

Remediation

Fix · CNA Rancher (SUSE) Fixed in 2.5.17
Fix · GHSA-g25r-gvq3-wrq7 github.com/rancher/rancher (Go) Fixed in 2.5.17 Advisory →
Fix · GHSA-g25r-gvq3-wrq7 github.com/rancher/rancher (Go) Fixed in 2.6.10 Advisory →
Fix · GHSA-g25r-gvq3-wrq7 github.com/rancher/rancher (Go) Fixed in 2.7.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-02-07
SUSE Rancher 2.5.17
4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2022-21491 Rancher: Exposure of sensitive fieldsPriority MEDIUM 44
- TI-2022-21493 Rancher: Privilege escalation via promoted rolesPriority MEDIUM 41
- TI-2022-21492 Rancher: Command injection in Git packagePriority LOW 37
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-21953
2026-10-03 Alias added: GHSA-g25r-gvq3-wrq7

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-21953

Other 3

TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
TI-2022-21489 Rancher: Non-random authentication token CVSS 3.1CRITICAL 9.8
TI-2019-08380 An issue was discovered that affects the following versions of Rancher: v2.0.0 through… CVSS 3.0CRITICAL 9.8
TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
TI-2022-21491 Rancher: Exposure of sensitive fields CVSS 3.1CRITICAL 9.9

See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences