en
Severity across 43 analyzed records
A short verification protects source data and prevents automated AI requests.
The GCVE catalog currently lists 81 vulnerability records affecting rancher.
Among the 43 records analyzed by CyStack, 31 are High or Critical and 0 appear in the CISA KEV catalog.
Compare the version you run with each vulnerability and the provider guidance below. The data only includes records analyzed so far.
| CVE | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-75035Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass | Exploitation statusNot known exploited | FixYes | Published09/03/2026 | SeverityHigh |
CVE-2026-75034Rancher: SAML Assertion Replay | Exploitation statusNot known exploited | FixYes | Published09/03/2026 | SeverityHigh |
CVE-2026-75033Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing | Exploitation statusNot known exploited | FixYes | Published09/03/2026 | SeverityHigh |
CVE-2026-71404Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole | Exploitation statusNot known exploited | FixYes | Published09/03/2026 | SeverityHigh |
CVE-2026-71403Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind | Exploitation statusNot known exploited | FixYes | Published09/03/2026 | SeverityMedium |
CVE-2026-44945Cross-Cluster Impersonation Confused-Deputy Privilege Escalation | Exploitation statusNot known exploited | FixYes | Published08/05/2026 | SeverityCritical |
CVE-2026-55998Cluster Existence Oracle via Unauthenticated Import Endpoint | Exploitation statusNot known exploited | FixYes | Published08/05/2026 | SeverityMedium |
CVE-2026-59675Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service | Exploitation statusNot known exploited | FixYes | Published08/05/2026 | SeverityHigh |
CVE-2026-55996Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent | Exploitation statusNot known exploited | FixYes | Published08/05/2026 | SeverityMedium |
CVE-2026-44938Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent | Exploitation statusNot known exploited | FixYes | Published07/07/2026 | SeverityHigh |
CVE-2026-44937SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components | Exploitation statusNot known exploited | FixYes | Published07/06/2026 | SeverityHigh |
CVE-2026-44936Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml | Exploitation statusNot known exploited | FixYes | Published07/06/2026 | SeverityMedium |
CVE-2026-44934Exposed tokens in SUSE Rancher AI Agent logs | Exploitation statusNot known exploited | FixYes | Published07/06/2026 | SeverityHigh |
CVE-2026-44935Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer | Exploitation statusNot known exploited | FixYes | Published07/02/2026 | SeverityCritical |
CVE-2026-44948Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler | Exploitation statusNot known exploited | FixYes | Published06/30/2026 | SeverityMedium |
CVE-2026-44949Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook | Exploitation statusNot known exploited | FixYes | Published06/30/2026 | SeverityHigh |
CVE-2026-44947Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher | Exploitation statusNot known exploited | FixYes | Published06/30/2026 | SeverityMedium |
CVE-2026-44946SAML Authentication Replay in Rancher | Exploitation statusNot known exploited | FixYes | Published06/30/2026 | SeverityCritical |
CVE-2026-41053Over-inclusive team membership expansion in GitHub App authentication provider for Rancher | Exploitation statusNot known exploited | FixYes | Published06/30/2026 | SeverityHigh |
CVE-2026-41052Rancher Privilege Escalation from Project Owner to Host | Exploitation statusNot known exploited | FixYes | Published06/29/2026 | SeverityCritical |
CVE-2026-44939Command injection through unsanitized YAML parameter in Rancher | Exploitation statusNot known exploited | FixYes | Published06/19/2026 | SeverityCritical |
CVE-2026-41050Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityCritical |
CVE-2026-25705Rancher Extensions have arbitrary file access via path traversal | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2025-62879Rancher Backup Operator pod's logs leak S3 tokens | Exploitation statusNot known exploited | FixYes | Published03/04/2026 | SeverityMedium |
CVE-2025-62878Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern | Exploitation statusNot known exploited | FixYes | Published02/25/2026 | SeverityCritical |
CVE-2025-67601Rancher CLI skips TLS verification on Rancher CLI login command | Exploitation statusNot known exploited | FixYes | Published02/25/2026 | SeverityHigh |
CVE-2024-58269Rancher exposes sensitive information through audit logs | Exploitation statusNot known exploited | FixYes | Published10/29/2025 | SeverityMedium |
CVE-2023-32199Rancher user retains access to clusters despite Global Role removal | Exploitation statusNot known exploited | FixYes | Published10/29/2025 | SeverityMedium |
CVE-2024-58260Rancher update on users can deny the service to the admin | Exploitation statusNot known exploited | FixYes | Published10/02/2025 | SeverityHigh |
CVE-2024-58267Rancher CLI SAML authentication is vulnerable to phishing attacks | Exploitation statusNot known exploited | FixYes | Published10/02/2025 | SeverityHigh |
CVE-2025-54468Rancher sends sensitive information to external services through the `/meta/proxy` endpoint | Exploitation statusNot known exploited | FixYes | Published10/02/2025 | SeverityMedium |
CVE-2024-58259Rancher affected by unauthenticated Denial of Service | Exploitation statusNot known exploited | FixYes | Published09/02/2025 | SeverityHigh |
CVE-2024-52284Rancher Fleet Helm Values are stored inside BundleDeployment in plain text | Exploitation statusNot known exploited | FixYes | Published09/02/2025 | SeverityHigh |
CVE-2023-32197Rancher's External RoleTemplates can lead to privilege escalation | Exploitation statusNot known exploited | FixYes | Published04/16/2025 | SeverityHigh |
CVE-2024-22036Rancher Remote Code Execution via Cluster/Node Drivers | Exploitation statusNot known exploited | FixYes | Published04/16/2025 | SeverityCritical |
CVE-2024-52281Stored Cross-site Scripting vulnerability in Rancher UI | Exploitation statusNot known exploited | FixYes | Published04/16/2025 | SeverityHigh |
CVE-2024-52280Users can issue watch commands for arbitrary resources | Exploitation statusNot known exploited | FixYes | Published04/11/2025 | SeverityHigh |
CVE-2024-52282Rancher Helm Applications may have sensitive values leaked | Exploitation statusNot known exploited | FixYes | Published04/11/2025 | SeverityMedium |
CVE-2025-23387Rancher's SAML-based login via CLI can be denied by unauthenticated users | Exploitation statusNot known exploited | FixYes | Published04/11/2025 | SeverityMedium |
CVE-2025-23388Unauthenticated stack overflow in /v3-public/authproviders API | Exploitation statusNot known exploited | FixYes | Published04/11/2025 | SeverityHigh |
CVE-2025-23389Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login | Exploitation statusNot known exploited | FixYes | Published04/11/2025 | SeverityHigh |
CVE-2025-23391Rancher: Restricted Administrator can change Administrator's passwords | Exploitation statusNot known exploited | FixYes | Published04/11/2025 | SeverityCritical |
CVE-2022-45157Exposure of vSphere's CPI and CSI credentials in Rancher | Exploitation statusNot known exploited | FixYes | Published11/13/2024 | SeverityHigh |
CVE-2024-22032Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec | Exploitation statusNot known exploited | FixYes | Published10/16/2024 | SeverityHigh |
CVE-2024-22030Rancher agents can be hijacked by taking over the Rancher Server URL | Exploitation statusNot known exploited | FixYes | Published10/16/2024 | SeverityHigh |
CVE-2023-32196Rancher's External RoleTemplates can lead to privilege escalation | Exploitation statusNot known exploited | FixYes | Published10/16/2024 | SeverityHigh |
CVE-2023-32194Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' | Exploitation statusNot known exploited | FixYes | Published10/16/2024 | SeverityHigh |
CVE-2023-22650Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider | Exploitation statusNot known exploited | FixYes | Published10/16/2024 | SeverityHigh |
CVE-2023-22649Rancher 'Audit Log' leaks sensitive information | Exploitation statusNot known exploited | FixYes | Published10/16/2024 | SeverityHigh |
CVE-2020-10676CVE-2020-10676 | Exploitation statusNot confirmed | FixNot confirmed | Published12/12/2023 | SeverityUnknown |
CVE-2022-43760CVE-2022-43760 | Exploitation statusNot known exploited | FixYes | Published06/01/2023 | SeverityHigh |
CVE-2023-22647CVE-2023-22647 | Exploitation statusNot known exploited | FixYes | Published06/01/2023 | SeverityCritical |
CVE-2023-22648CVE-2023-22648 | Exploitation statusNot confirmed | FixYes | Published06/01/2023 | SeverityHigh |
CVE-2023-22651CVE-2023-22651 | Exploitation statusNot known exploited | FixYes | Published05/04/2023 | SeverityCritical |
CVE-2022-43755Rancher: Non-random authentication token | Exploitation statusNot known exploited | FixYes | Published02/07/2023 | SeverityHigh |
CVE-2022-43758Rancher: Command injection in Git package | Exploitation statusNot known exploited | FixYes | Published02/07/2023 | SeverityHigh |
CVE-2022-21953Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster | Exploitation statusNot known exploited | FixYes | Published02/07/2023 | SeverityHigh |
CVE-2022-43759Rancher: Privilege escalation via promoted roles | Exploitation statusNot known exploited | FixYes | Published02/07/2023 | SeverityHigh |
CVE-2022-43757Rancher: Exposure of sensitive fields | Exploitation statusNot known exploited | FixYes | Published02/07/2023 | SeverityCritical |
CVE-2022-43756Rancher/Wrangler: Denial of service when processing Git credentials | Exploitation statusNot known exploited | FixNot confirmed | Published02/07/2023 | SeverityMedium |
CVE-2022-31249[RANCHER] OS command injection in Rancher and Fleet | Exploitation statusNot known exploited | FixNot confirmed | Published02/07/2023 | SeverityHigh |
CVE-2022-31247Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB) | Exploitation statusNot confirmed | FixYes | Published09/07/2022 | SeverityCritical |
CVE-2021-36783Rancher: Failure to properly sanitize credentials in cluster template answers | Exploitation statusNot confirmed | FixYes | Published09/07/2022 | SeverityCritical |
CVE-2021-36782Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object | Exploitation statusNot confirmed | FixYes | Published09/07/2022 | SeverityCritical |
CVE-2022-21951Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden | Exploitation statusNot confirmed | FixYes | Published05/25/2022 | SeverityMedium |
CVE-2021-4200Write access to the Catalog for any user when restricted-admin role is enabled | Exploitation statusNot confirmed | FixYes | Published05/02/2022 | SeverityMedium |
CVE-2021-36784Privilege escalation for users with create/update permissions in Global Roles | Exploitation statusNot confirmed | FixYes | Published05/02/2022 | SeverityHigh |
CVE-2021-36778Exposure of repository credentials to external third-party sources | Exploitation statusNot confirmed | FixYes | Published05/02/2022 | SeverityHigh |
CVE-2021-36776Steve API proxy impersonation | Exploitation statusNot confirmed | FixYes | Published04/01/2022 | SeverityHigh |
CVE-2021-36775Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings | Exploitation statusNot confirmed | FixYes | Published04/01/2022 | SeverityHigh |
CVE-2022-21947rancher desktop: Dashboard API is network accessible | Exploitation statusNot confirmed | FixYes | Published04/01/2022 | SeverityHigh |
CVE-2021-32001K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token | Exploitation statusNot confirmed | FixNot confirmed | Published07/28/2021 | SeverityMedium |
CVE-2021-25313Rancher: XSS on /v3/cluster/ | Exploitation statusNot confirmed | FixYes | Published03/05/2021 | SeverityHigh |
CVE-2019-13209CVE-2019-13209 | Exploitation statusNot confirmed | FixNot confirmed | Published09/04/2019 | SeverityUnknown |
CVE-2019-11202CVE-2019-11202 | Exploitation statusNot confirmed | FixNot confirmed | Published07/30/2019 | SeverityUnknown |
CVE-2019-11881CVE-2019-11881 | Exploitation statusNot confirmed | FixNot confirmed | Published06/10/2019 | SeverityUnknown |
CVE-2019-12274CVE-2019-12274 | Exploitation statusNot confirmed | FixNot confirmed | Published06/06/2019 | SeverityUnknown |
CVE-2019-12303CVE-2019-12303 | Exploitation statusNot confirmed | FixNot confirmed | Published06/06/2019 | SeverityUnknown |
CVE-2019-6287CVE-2019-6287 | Exploitation statusNot confirmed | FixNot confirmed | Published04/10/2019 | SeverityUnknown |
CVE-2018-20321CVE-2018-20321 | Exploitation statusNot confirmed | FixNot confirmed | Published04/10/2019 | SeverityUnknown |
CVE-2017-7297CVE-2017-7297 | Exploitation statusNot confirmed | FixYes | Published03/29/2017 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
