Read the docs
TI-2022-21489 Aliases CVE-2022-43755GHSA-8c69-r38j-rpfj

Rancher: Non-random authentication token

Priority MEDIUM 46CWE-331Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issue affects: SUSE Rancher Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0172 77th percentileScored 2026-11-07
Fix Fixed Rancher (SUSE): 2.6.10github.com/rancher/rancher (Go): 2.6.10, 2.7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSERancherRancher to before 2.6.102.6.10Patch availableCNA
—github.com/rancher/rancher (Go)2.6.0 to before 2.6.102.6.10Patch availableGHSA-8c69-r38j-rpfj
—github.com/rancher/rancher (Go)2.7.0 to before 2.7.12.7.1Patch availableGHSA-8c69-r38j-rpfj
  • Rancher VendorSUSE Affected Rancher to before 2.6.10 Fixed in 2.6.10 Patch available CNA
  • github.com/rancher/rancher (Go) Vendor— Affected 2.6.0 to before 2.6.10 Fixed in 2.6.10 Patch available GHSA-8c69-r38j-rpfj
  • github.com/rancher/rancher (Go) Vendor— Affected 2.7.0 to before 2.7.1 Fixed in 2.7.1 Patch available GHSA-8c69-r38j-rpfj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*2.6.0 to before 2.6.10; 2.7.0 to before 2.7.1VulnerableSUSE
  • cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* Versions 2.6.0 to before 2.6.10; 2.7.0 to before 2.7.1 Vulnerable ·SUSE

Remediation

  • Fix · CNA Rancher (SUSE) Fixed in 2.6.10
  • Fix · GHSA-8c69-r38j-rpfj github.com/rancher/rancher (Go) Fixed in 2.6.10 Advisory →
  • Fix · GHSA-8c69-r38j-rpfj github.com/rancher/rancher (Go) Fixed in 2.7.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SUSE Rancher 2.6.10

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2022-21493 Rancher: Privilege escalation via promoted rolesPriority MEDIUM 41
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43755
  2. 2026-10-03 Alias added: GHSA-8c69-r38j-rpfj

References

Patch 1

Advisory 1

Other 2

  • TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
  • TI-2019-08380 An issue was discovered that affects the following versions of Rancher: v2.0.0 through… CVSS 3.0CRITICAL 9.8
  • TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
  • TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
  • TI-2022-21491 Rancher: Exposure of sensitive fields CVSS 3.1CRITICAL 9.9
  • TI-2021-14904 Rancher: Failure to properly sanitize credentials in cluster template answers CVSS 3.1CRITICAL 9.9
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences