Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Rancher — Vulnerabilities & Security Advisories 90

All 90 CVE vulnerabilities found in Rancher, with AI-generated Chinese analysis, references, and POCs.

This page documents known software weaknesses affecting Rancher, the popular open-source container management platform developed by SUSE. It aggregates vulnerability records associated with the product, encompassing both direct application flaws and issues within its integrated components or dependencies. The collection spans historical entries from the early adoption of the platform through recent updates, ensuring a comprehensive view of the security landscape surrounding Rancher over time. By accessing this resource, users can systematically track vendor advisories issued by SUSE and other relevant security entities regarding Rancher-specific issues. This facilitates a deeper understanding of specific weakness classes that impact container orchestration and management tools. Furthermore, researchers and administrators can look up the product’s vulnerability history to assess the evolution of security patches and identify recurring patterns in reported defects. The data provided here supports informed risk management decisions by highlighting how different versions of Rancher have been affected by various categories of vulnerabilities. It serves as a neutral reference for evaluating the current security posture of Rancher deployments without emphasizing any specific product features or commercial benefits. Users interested in compliance, auditing, or general security awareness will find structured information that clarifies the nature and frequency of reported issues. This approach ensures that the content remains strictly informational, focusing on factual vulnerability data rather than promotional material or subjective analysis of the software’s market position.

Vendor: SUSE

CVE ID Title CVSS Severity Published
CVE-2023-32196 Rancher's External RoleTemplates can lead to privilege escalation CWE-269 6.6 Medium 2024-10-16
CVE-2023-32194 Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' CWE-269 7.2 High 2024-10-16
CVE-2023-22650 Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider CWE-287 8.8 High 2024-10-16
CVE-2023-22649 Rancher 'Audit Log' leaks sensitive information CWE-532 8.4 High 2024-10-16
CVE-2022-43760 Rancher Labs Rancher 跨站脚本漏洞 CWE-79 8.4 High 2023-06-01
CVE-2023-22647 Rancher Labs Rancher 安全漏洞 CWE-267 9.9 Critical 2023-06-01
CVE-2023-22648 Rancher Labs Rancher 安全漏洞 CWE-271 8.0 High 2023-06-01
CVE-2023-22651 Rancher 安全漏洞 CWE-269 9.9 Critical 2023-05-04
CVE-2022-21953 Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster CWE-862 7.4 High 2023-02-07
CVE-2022-31249 [RANCHER] OS command injection in Rancher and Fleet CWE-78 7.5 High 2023-02-07
CVE-2022-43755 Rancher: Non-random authentication token CWE-331 7.1 High 2023-02-07
CVE-2022-43756 Rancher/Wrangler: Denial of service when processing Git credentials CWE-74 5.9 Medium 2023-02-07
CVE-2022-43757 Rancher: Exposure of sensitive fields CWE-312 9.9 Critical 2023-02-07
CVE-2022-43758 Rancher: Command injection in Git package CWE-78 7.6 High 2023-02-07
CVE-2022-43759 Rancher: Privilege escalation via promoted roles CWE-269 7.2 High 2023-02-07
CVE-2022-31247 Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB) CWE-285 9.1 Critical 2022-09-07
CVE-2021-36783 Rancher: Failure to properly sanitize credentials in cluster template answers CWE-522 9.9 Critical 2022-09-07
CVE-2021-36782 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CWE-312 9.9 Critical 2022-09-07
CVE-2022-21951 Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden CWE-319 6.8 Medium 2022-05-25
CVE-2021-4200 Write access to the Catalog for any user when restricted-admin role is enabled CWE-269 5.4 Medium 2022-05-02
CVE-2021-36784 Privilege escalation for users with create/update permissions in Global Roles CWE-269 7.2 High 2022-05-02
CVE-2021-36778 Exposure of repository credentials to external third-party sources CWE-863 7.3 High 2022-05-02
CVE-2021-36776 Steve API proxy impersonation CWE-284 8.8 High 2022-04-01
CVE-2021-36775 Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings CWE-284 8.8 High 2022-04-01
CVE-2022-21947 rancher desktop: Dashboard API is network accessible CWE-668 8.3 High 2022-04-01
CVE-2021-32001 K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token CWE-311 6.5 Medium 2021-07-28
CVE-2021-31999 Rancher: Privilege escalation vulnerability via malicious Connection header CWE-807 8.8 High 2021-07-15
CVE-2021-25320 Rancher: Cloud credentials can be used through proxy API by users without access CWE-284 9.9 Critical 2021-07-15
CVE-2021-25318 rancher: API group not properly specified when creating Kubernetes RBAC resources CWE-732 8.8 High 2021-07-15
CVE-2021-25313 Rancher: XSS on /v3/cluster/ CWE-79 7.1 High 2021-03-05

All 90 known CVE vulnerabilities affecting Rancher with full Chinese analysis, references, and POCs where available.