| Rancher has Privilege Escalation from Project Owner to HostCVE-2026-41052 · GHSA-VX8H-4PRV-G744Version ranges need review. |
github.com/rancher/rancher |
Go |
Critical
|
Fix reported |
|
| Rancher has over-inclusive team membership expansion in GitHub App authentication providerCVE-2026-41053 · GHSA-4J6X-2764-M8GHVersion ranges need review. |
github.com/rancher/rancher |
Go |
High
|
Fix reported |
|
| Rancher Extensions have arbitrary file access via path traversalCVE-2026-25705 · GHSA-5V3H-X4WF-5C35Version ranges need review. |
github.com/rancher/rancher |
Go |
High
|
Fix reported |
|
| Rancher vulnerable to command injection through unsanitized YAML parameterCVE-2026-44939 · GHSA-MHC6-2GFQ-XX62Version ranges need review. |
github.com/rancher/rancher |
Go |
Critical
|
Fix reported |
|
| Rancher cloud credentials can be used through proxy API by users without accessCVE-2021-25320 · GHSA-GQF8-RVRH-G7W6Version ranges need review. |
github.com/rancher/rancher |
Go |
Critical
|
Fix reported |
|
| Rancher CLI SAML authentication is vulnerable to phishing attacksCVE-2024-58267 · GHSA-V3VJ-5868-2CH2Version ranges need review. |
github.com/rancher/rancher |
Go |
High
|
Fix reported |
|
| Rancher update on users can deny the service to the adminCVE-2024-58260 · GHSA-Q82V-H4RQ-5C86Version ranges need review. |
github.com/rancher/rancher |
Go |
High
|
Fix reported |
|
| Rancher sends sensitive information to external services through the `/meta/proxy` endpointCVE-2025-54468 · GHSA-MJCP-RJ3C-36FRVersion ranges need review. |
github.com/rancher/rancher |
Go |
Medium
|
Fix reported |
|
| Rancher users who can create Projects can gain access to arbitrary projectsCVE-2024-22031 · GHSA-8H6M-WV39-239MVersion ranges need review. |
github.com/rancher/rancher |
Go |
High
|
Fix reported |
|
| Rancher: Restricted Administrator can change Administrator's passwordsCVE-2025-23391 · GHSA-8P83-CPFG-FJ3GVersion ranges need review. |
github.com/rancher/rancher |
Go |
Critical
|
Fix reported |
|
| Rancher's SAML-based login via CLI can be denied by unauthenticated usersCVE-2025-23387 · GHSA-5QMP-9X47-92Q8Version ranges need review. |
github.com/rancher/rancher |
Go |
Medium
|
Fix reported |
|
| Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First LoginCVE-2025-23389 · GHSA-MQ23-VVG7-XFM4Version ranges need review. |
github.com/rancher/rancher |
Go |
High
|
Fix reported |
|
| Rancher UI has Stored Cross-site Scripting vulnerabilityCVE-2024-52281 · GHSA-2V2W-8V8C-WCM9Version ranges need review. |
github.com/rancher/rancher |
Go |
High
|
Fix reported |
|
| Rancher Helm Applications may have sensitive values leakedCVE-2024-52282 · GHSA-9C5P-35GJ-JQP4Version ranges need review. |
github.com/rancher/rancher |
Go |
Medium
|
Fix reported |
|
| Exposure of vSphere's CPI and CSI credentials in RancherCVE-2022-45157 · GHSA-XJ7W-R753-VJ8VVersion ranges need review. |
github.com/rancher/rancher |
Go |
High
|
Fix reported |
|
| Rancher Remote Code Execution via Cluster/Node DriversCVE-2024-22036 · GHSA-H99M-6755-RGWCVersion ranges need review. |
github.com/rancher/rancher |
Go |
Critical
|
Fix reported |
|
| Rancher agents can be hijacked by taking over the Rancher Server URLCVE-2024-22030 · GHSA-H4H5-9833-V2P4Version ranges need review. |
github.com/rancher/rancher |
Go |
High
|
Fix reported |
|
| Rancher does not automatically clean up a user deleted or disabled from the configured Authentication ProviderCVE-2023-22650 · GHSA-9GHH-MMCQ-8PHCVersion ranges need review. |
github.com/rancher/rancher |
Go |
High
|
Fix reported |
|
| Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpecCVE-2024-22032 · GHSA-Q6C7-56CQ-G2WMVersion ranges need review. |
github.com/rancher/rancher |
Go |
High
|
Fix reported |
|
| Rancher Privilege escalation vulnerability via malicious "Connection" headerCVE-2021-31999 · GHSA-PVXJ-25M6-7VQRVersion ranges need review. |
github.com/rancher/rancher |
Go |
High
|
Fix reported |
|
