Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Rancher — Vulnerabilities & Security Advisories 90

All 90 CVE vulnerabilities found in Rancher, with AI-generated Chinese analysis, references, and POCs.

This page documents known software weaknesses affecting Rancher, the popular open-source container management platform developed by SUSE. It aggregates vulnerability records associated with the product, encompassing both direct application flaws and issues within its integrated components or dependencies. The collection spans historical entries from the early adoption of the platform through recent updates, ensuring a comprehensive view of the security landscape surrounding Rancher over time. By accessing this resource, users can systematically track vendor advisories issued by SUSE and other relevant security entities regarding Rancher-specific issues. This facilitates a deeper understanding of specific weakness classes that impact container orchestration and management tools. Furthermore, researchers and administrators can look up the product’s vulnerability history to assess the evolution of security patches and identify recurring patterns in reported defects. The data provided here supports informed risk management decisions by highlighting how different versions of Rancher have been affected by various categories of vulnerabilities. It serves as a neutral reference for evaluating the current security posture of Rancher deployments without emphasizing any specific product features or commercial benefits. Users interested in compliance, auditing, or general security awareness will find structured information that clarifies the nature and frequency of reported issues. This approach ensures that the content remains strictly informational, focusing on factual vulnerability data rather than promotional material or subjective analysis of the software’s market position.

Vendor: SUSE

CVE ID Title CVSS Severity Published
CVE-2026-44949 Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook CWE-306 - - 2026-06-30
CVE-2026-44947 Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher CWE-281 - - 2026-06-30
CVE-2026-44946 SAML Authentication Replay in Rancher CWE-294 - - 2026-06-30
CVE-2026-41053 Over-inclusive team membership expansion in GitHub App authentication provider for Rancher CWE-303 8.8 High 2026-06-30
CVE-2026-41052 Rancher Privilege Escalation from Project Owner to Host CWE-305 - - 2026-06-29
CVE-2026-44939 Command injection through unsanitized YAML parameter in Rancher CWE-95 9.4 Critical 2026-06-19
CVE-2026-41050 Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering CWE-863 9.9 Critical 2026-05-13
CVE-2026-25705 Rancher Extensions have arbitrary file access via path traversal CWE-35 8.4 High 2026-05-13
CVE-2025-62879 Rancher Backup Operator pod's logs leak S3 tokens CWE-532 6.8 Medium 2026-03-04
CVE-2025-62878 Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern CWE-23 9.9 Critical 2026-02-25
CVE-2025-67601 Rancher CLI skips TLS verification on Rancher CLI login command CWE-295 8.3 High 2026-02-25
CVE-2024-58269 Rancher exposes sensitive information through audit logs CWE-532 4.3 Medium 2025-10-29
CVE-2023-32199 Rancher user retains access to clusters despite Global Role removal CWE-281 4.3 Medium 2025-10-29
CVE-2024-58260 Rancher update on users can deny the service to the admin CWE-863 7.6 High 2025-10-02
CVE-2024-58267 Rancher CLI SAML authentication is vulnerable to phishing attacks CWE-345 8.0 High 2025-10-02
CVE-2025-54468 Rancher sends sensitive information to external services through the `/meta/proxy` endpoint CWE-200 4.7 Medium 2025-10-02
CVE-2024-58259 Rancher affected by unauthenticated Denial of Service CWE-770 8.2 High 2025-09-02
CVE-2024-52284 Rancher Fleet Helm Values are stored inside BundleDeployment in plain text CWE-312 7.7 High 2025-09-02
CVE-2023-32197 Rancher's External RoleTemplates can lead to privilege escalation CWE-269 6.6 Medium 2025-04-16
CVE-2024-22036 Rancher Remote Code Execution via Cluster/Node Drivers CWE-269 9.1 Critical 2025-04-16
CVE-2024-52281 Stored Cross-site Scripting vulnerability in Rancher UI CWE-79 8.9 High 2025-04-16
CVE-2024-52280 Users can issue watch commands for arbitrary resources CWE-200 7.7 High 2025-04-11
CVE-2024-52282 Rancher Helm Applications may have sensitive values leaked CWE-200 6.2 Medium 2025-04-11
CVE-2025-23387 Rancher's SAML-based login via CLI can be denied by unauthenticated users CWE-200 5.3 Medium 2025-04-11
CVE-2025-23388 Unauthenticated stack overflow in /v3-public/authproviders API CWE-121 8.2 High 2025-04-11
CVE-2025-23389 Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login CWE-284 8.4 High 2025-04-11
CVE-2025-23391 Rancher: Restricted Administrator can change Administrator's passwords CWE-266 9.1 Critical 2025-04-11
CVE-2022-45157 Exposure of vSphere's CPI and CSI credentials in Rancher CWE-522 9.1 Critical 2024-11-13
CVE-2024-22032 Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec CWE-200 6.5 Medium 2024-10-16
CVE-2024-22030 Rancher agents can be hijacked by taking over the Rancher Server URL CWE-295 8.0 High 2024-10-16

All 90 known CVE vulnerabilities affecting Rancher with full Chinese analysis, references, and POCs where available.