Rancher
- Software type
- Orchestration platform
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/12/2026, Rancher recorded 19 security vulnerabilities in the last 90 days, of which 14 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Rancher and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-94290Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controllerCVE-2026-88811Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxyCVE-2026-88810Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRulesCVE-2026-88809Rancher meta proxy allowlist bypass leading to server-side request forgeryCVE-2026-104623Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-94290Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller | Exploitation statusNot exploited | FixYes |
| SeverityCritical |
CVE-2026-88811Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy | Exploitation statusNot exploited | FixYes | Published11/02/2026 | SeverityCritical |
|---|
CVE-2026-88810Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRules | Exploitation statusNot exploited | FixYes | Published11/02/2026 | SeverityHigh |
|---|
CVE-2026-88809Rancher meta proxy allowlist bypass leading to server-side request forgery | Exploitation statusNot exploited | FixYes | Published11/02/2026 | SeverityHigh |
|---|
CVE-2026-104623Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster | Exploitation statusNot exploited | FixYes | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-104615Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace | Exploitation statusNot confirmed | FixYes | Published10/30/2026 | SeverityHigh |
|---|
CVE-2024-22031Rancher users who can create Projects can gain access to arbitrary projects | Exploitation statusNot exploited | FixYes | Published10/15/2026 | SeverityHigh |
|---|
CVE-2026-93540Fleet applies namespace labels and annotations without the bundle's service account privileges | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-93539Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-93538Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
|---|
CVE-2026-93537Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-88808Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
|---|
CVE-2026-88805Session Not Revoked Server-Side on Logout in Rancher | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
|---|
CVE-2026-88804Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityCritical |
|---|
CVE-2026-75035Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass | Exploitation statusNot exploited | FixYes | Published09/03/2026 | SeverityHigh |
|---|
CVE-2026-75034Rancher: SAML Assertion Replay | Exploitation statusNot exploited | FixYes | Published09/03/2026 | SeverityHigh |
|---|
CVE-2026-75033Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing | Exploitation statusNot exploited | FixYes | Published09/03/2026 | SeverityHigh |
|---|
CVE-2026-71404Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole | Exploitation statusNot exploited | FixYes | Published09/03/2026 | SeverityHigh |
|---|
CVE-2026-71403Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind | Exploitation statusNot exploited | FixYes | Published09/03/2026 | SeverityMedium |
|---|
CVE-2026-59675Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service | Exploitation statusNot exploited | FixYes | Published08/05/2026 | SeverityHigh |
|---|
CVE-2026-55998Cluster Existence Oracle via Unauthenticated Import Endpoint | Exploitation statusNot exploited | FixYes | Published08/05/2026 | SeverityMedium |
|---|
CVE-2026-55996Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent | Exploitation statusNot exploited | FixYes | Published08/05/2026 | SeverityMedium |
|---|
CVE-2026-44945Cross-Cluster Impersonation Confused-Deputy Privilege Escalation | Exploitation statusNot exploited | FixYes | Published08/05/2026 | SeverityCritical |
|---|
CVE-2026-44938Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent | Exploitation statusNot exploited | FixYes | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-44937SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-44936Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-44934Exposed tokens in SUSE Rancher AI Agent logs | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-44935Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer | Exploitation statusNot exploited | FixYes | Published07/02/2026 | SeverityCritical |
|---|
CVE-2026-44949Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook | Exploitation statusNot exploited | FixYes | Published06/30/2026 | SeverityHigh |
|---|
CVE-2026-44948Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler | Exploitation statusNot exploited | FixYes | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-44947Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher | Exploitation statusNot exploited | FixYes | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-44946SAML Authentication Replay in Rancher | Exploitation statusNot exploited | FixYes | Published06/30/2026 | SeverityCritical |
|---|
CVE-2026-41053Over-inclusive team membership expansion in GitHub App authentication provider for Rancher | Exploitation statusNot exploited | FixYes | Published06/30/2026 | SeverityHigh |
|---|
CVE-2026-41052Rancher Privilege Escalation from Project Owner to Host | Exploitation statusNot exploited | FixYes | Published06/29/2026 | SeverityCritical |
|---|
CVE-2026-44939Command injection through unsanitized YAML parameter in Rancher | Exploitation statusNot exploited | FixYes | Published06/19/2026 | SeverityCritical |
|---|
CVE-2026-41050Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityCritical |
|---|
CVE-2026-25705Rancher Extensions have arbitrary file access via path traversal | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityHigh |
|---|
CVE-2025-62879Rancher Backup Operator pod's logs leak S3 tokens | Exploitation statusNot exploited | FixYes | Published03/04/2026 | SeverityMedium |
|---|
CVE-2025-67601Rancher CLI skips TLS verification on Rancher CLI login command | Exploitation statusNot exploited | FixYes | Published02/25/2026 | SeverityHigh |
|---|
CVE-2025-62878Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern | Exploitation statusNot exploited | FixYes | Published02/25/2026 | SeverityCritical |
|---|
CVE-2024-58269Rancher exposes sensitive information through audit logs | Exploitation statusNot exploited | FixYes | Published10/29/2025 | SeverityMedium |
|---|
CVE-2023-32199Rancher user retains access to clusters despite Global Role removal | Exploitation statusNot exploited | FixYes | Published10/29/2025 | SeverityMedium |
|---|
CVE-2025-54468Rancher sends sensitive information to external services through the `/meta/proxy` endpoint | Exploitation statusNot exploited | FixYes | Published10/02/2025 | SeverityMedium |
|---|
CVE-2024-58267Rancher CLI SAML authentication is vulnerable to phishing attacks | Exploitation statusNot exploited | FixYes | Published10/02/2025 | SeverityHigh |
|---|
CVE-2024-58260Rancher update on users can deny the service to the admin | Exploitation statusNot exploited | FixYes | Published10/02/2025 | SeverityHigh |
|---|
CVE-2024-58259Rancher affected by unauthenticated Denial of Service | Exploitation statusNot exploited | FixYes | Published09/02/2025 | SeverityHigh |
|---|
CVE-2024-52284Rancher Fleet Helm Values are stored inside BundleDeployment in plain text | Exploitation statusNot exploited | FixYes | Published09/02/2025 | SeverityHigh |
|---|
CVE-2024-52281Stored Cross-site Scripting vulnerability in Rancher UI | Exploitation statusNot exploited | FixYes | Published04/16/2025 | SeverityHigh |
|---|
CVE-2024-22036Rancher Remote Code Execution via Cluster/Node Drivers | Exploitation statusNot exploited | FixYes | Published04/16/2025 | SeverityCritical |
|---|
CVE-2023-32197Rancher's External RoleTemplates can lead to privilege escalation | Exploitation statusNot exploited | FixYes | Published04/16/2025 | SeverityHigh |
|---|
86 Results | Page 1 of 2