Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

rancher Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Published	Severity

`CVE-2026-88804`Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher	Exploitation statusNot known exploited	FixYes	Published09/28/2026	SeverityCritical
`CVE-2026-88805`Session Not Revoked Server-Side on Logout in Rancher	Exploitation statusNot known exploited	FixYes	Published09/28/2026	SeverityHigh
`CVE-2026-88808`Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters	Exploitation statusNot known exploited	FixYes	Published09/28/2026	SeverityHigh
`CVE-2026-93540`Fleet applies namespace labels and annotations without the bundle's service account privileges	Exploitation statusNot known exploited	FixYes	Published09/28/2026	SeverityMedium
`CVE-2026-93539`Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver	Exploitation statusNot known exploited	FixYes	Published09/28/2026	SeverityMedium
`CVE-2026-93538`Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet	Exploitation statusNot known exploited	FixYes	Published09/28/2026	SeverityHigh
`CVE-2026-93537`Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory	Exploitation statusNot known exploited	FixYes	Published09/28/2026	SeverityMedium
`CVE-2026-75035`Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass	Exploitation statusNot known exploited	FixYes	Published09/03/2026	SeverityHigh
`CVE-2026-75034`Rancher: SAML Assertion Replay	Exploitation statusNot known exploited	FixYes	Published09/03/2026	SeverityHigh
`CVE-2026-75033`Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing	Exploitation statusNot known exploited	FixYes	Published09/03/2026	SeverityHigh
`CVE-2026-71404`Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole	Exploitation statusNot known exploited	FixYes	Published09/03/2026	SeverityHigh
`CVE-2026-71403`Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind	Exploitation statusNot known exploited	FixYes	Published09/03/2026	SeverityMedium
`CVE-2026-44945`Cross-Cluster Impersonation Confused-Deputy Privilege Escalation	Exploitation statusNot known exploited	FixYes	Published08/05/2026	SeverityCritical
`CVE-2026-55998`Cluster Existence Oracle via Unauthenticated Import Endpoint	Exploitation statusNot known exploited	FixYes	Published08/05/2026	SeverityMedium
`CVE-2026-59675`Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service	Exploitation statusNot known exploited	FixYes	Published08/05/2026	SeverityHigh
`CVE-2026-55996`Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent	Exploitation statusNot known exploited	FixYes	Published08/05/2026	SeverityMedium
`CVE-2026-44938`Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent	Exploitation statusNot known exploited	FixYes	Published07/07/2026	SeverityHigh
`CVE-2026-44937`SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components	Exploitation statusNot known exploited	FixYes	Published07/06/2026	SeverityHigh
`CVE-2026-44936`Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml	Exploitation statusNot known exploited	FixYes	Published07/06/2026	SeverityMedium
`CVE-2026-44934`Exposed tokens in SUSE Rancher AI Agent logs	Exploitation statusNot known exploited	FixYes	Published07/06/2026	SeverityHigh
`CVE-2026-44935`Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer	Exploitation statusNot known exploited	FixYes	Published07/02/2026	SeverityCritical
`CVE-2026-44948`Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler	Exploitation statusNot known exploited	FixYes	Published06/30/2026	SeverityMedium
`CVE-2026-44949`Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook	Exploitation statusNot known exploited	FixYes	Published06/30/2026	SeverityHigh
`CVE-2026-44947`Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher	Exploitation statusNot known exploited	FixYes	Published06/30/2026	SeverityMedium
`CVE-2026-44946`SAML Authentication Replay in Rancher	Exploitation statusNot known exploited	FixYes	Published06/30/2026	SeverityCritical
`CVE-2026-41053`Over-inclusive team membership expansion in GitHub App authentication provider for Rancher	Exploitation statusNot known exploited	FixYes	Published06/30/2026	SeverityHigh
`CVE-2026-41052`Rancher Privilege Escalation from Project Owner to Host	Exploitation statusNot known exploited	FixYes	Published06/29/2026	SeverityCritical
`CVE-2026-44939`Command injection through unsanitized YAML parameter in Rancher	Exploitation statusNot known exploited	FixYes	Published06/19/2026	SeverityCritical
`CVE-2026-41050`Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering	Exploitation statusNot known exploited	FixYes	Published05/13/2026	SeverityCritical
`CVE-2026-25705`Rancher Extensions have arbitrary file access via path traversal	Exploitation statusNot known exploited	FixYes	Published05/13/2026	SeverityHigh
`CVE-2025-62879`Rancher Backup Operator pod's logs leak S3 tokens	Exploitation statusNot known exploited	FixYes	Published03/04/2026	SeverityMedium
`CVE-2025-62878`Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern	Exploitation statusNot known exploited	FixYes	Published02/25/2026	SeverityCritical
`CVE-2025-67601`Rancher CLI skips TLS verification on Rancher CLI login command	Exploitation statusNot known exploited	FixYes	Published02/25/2026	SeverityHigh
`CVE-2024-58269`Rancher exposes sensitive information through audit logs	Exploitation statusNot known exploited	FixYes	Published10/29/2025	SeverityMedium
`CVE-2023-32199`Rancher user retains access to clusters despite Global Role removal	Exploitation statusNot known exploited	FixYes	Published10/29/2025	SeverityMedium
`CVE-2024-58260`Rancher update on users can deny the service to the admin	Exploitation statusNot known exploited	FixYes	Published10/02/2025	SeverityHigh
`CVE-2024-58267`Rancher CLI SAML authentication is vulnerable to phishing attacks	Exploitation statusNot known exploited	FixYes	Published10/02/2025	SeverityHigh
`CVE-2025-54468`Rancher sends sensitive information to external services through the `/meta/proxy` endpoint	Exploitation statusNot known exploited	FixYes	Published10/02/2025	SeverityMedium
`CVE-2024-58259`Rancher affected by unauthenticated Denial of Service	Exploitation statusNot known exploited	FixYes	Published09/02/2025	SeverityHigh
`CVE-2024-52284`Rancher Fleet Helm Values are stored inside BundleDeployment in plain text	Exploitation statusNot known exploited	FixYes	Published09/02/2025	SeverityHigh
`CVE-2023-32197`Rancher's External RoleTemplates can lead to privilege escalation	Exploitation statusNot known exploited	FixYes	Published04/16/2025	SeverityHigh
`CVE-2024-22036`Rancher Remote Code Execution via Cluster/Node Drivers	Exploitation statusNot known exploited	FixYes	Published04/16/2025	SeverityCritical
`CVE-2024-52281`Stored Cross-site Scripting vulnerability in Rancher UI	Exploitation statusNot known exploited	FixYes	Published04/16/2025	SeverityHigh
`CVE-2024-52280`Users can issue watch commands for arbitrary resources	Exploitation statusNot known exploited	FixYes	Published04/11/2025	SeverityHigh
`CVE-2024-52282`Rancher Helm Applications may have sensitive values leaked	Exploitation statusNot known exploited	FixYes	Published04/11/2025	SeverityMedium
`CVE-2025-23387`Rancher's SAML-based login via CLI can be denied by unauthenticated users	Exploitation statusNot known exploited	FixYes	Published04/11/2025	SeverityMedium
`CVE-2025-23388`Unauthenticated stack overflow in /v3-public/authproviders API	Exploitation statusNot known exploited	FixYes	Published04/11/2025	SeverityHigh
`CVE-2025-23389`Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login	Exploitation statusNot known exploited	FixYes	Published04/11/2025	SeverityHigh
`CVE-2025-23391`Rancher: Restricted Administrator can change Administrator's passwords	Exploitation statusNot known exploited	FixYes	Published04/11/2025	SeverityCritical
`CVE-2022-45157`Exposure of vSphere's CPI and CSI credentials in Rancher	Exploitation statusNot known exploited	FixYes	Published11/13/2024	SeverityHigh
`CVE-2024-22032`Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec	Exploitation statusNot known exploited	FixYes	Published10/16/2024	SeverityHigh
`CVE-2024-22030`Rancher agents can be hijacked by taking over the Rancher Server URL	Exploitation statusNot known exploited	FixYes	Published10/16/2024	SeverityHigh
`CVE-2023-32196`Rancher's External RoleTemplates can lead to privilege escalation	Exploitation statusNot known exploited	FixYes	Published10/16/2024	SeverityHigh
`CVE-2023-32194`Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'	Exploitation statusNot known exploited	FixYes	Published10/16/2024	SeverityHigh
`CVE-2023-22650`Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider	Exploitation statusNot known exploited	FixYes	Published10/16/2024	SeverityHigh
`CVE-2023-22649`Rancher 'Audit Log' leaks sensitive information	Exploitation statusNot known exploited	FixYes	Published10/16/2024	SeverityHigh
`CVE-2020-10676`	Exploitation statusNot confirmed	FixNot confirmed	Published12/12/2023	SeverityUnknown
`CVE-2022-43760`	Exploitation statusNot known exploited	FixYes	Published06/01/2023	SeverityHigh
`CVE-2023-22647`	Exploitation statusNot known exploited	FixYes	Published06/01/2023	SeverityCritical
`CVE-2023-22648`	Exploitation statusNot confirmed	FixYes	Published06/01/2023	SeverityHigh
`CVE-2023-22651`	Exploitation statusNot known exploited	FixYes	Published05/04/2023	SeverityCritical
`CVE-2022-43756`Rancher/Wrangler: Denial of service when processing Git credentials	Exploitation statusNot known exploited	FixNot confirmed	Published02/07/2023	SeverityMedium
`CVE-2022-43755`Rancher: Non-random authentication token	Exploitation statusNot known exploited	FixYes	Published02/07/2023	SeverityHigh
`CVE-2022-43759`Rancher: Privilege escalation via promoted roles	Exploitation statusNot known exploited	FixYes	Published02/07/2023	SeverityHigh
`CVE-2022-21953`Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster	Exploitation statusNot known exploited	FixYes	Published02/07/2023	SeverityHigh
`CVE-2022-43758`Rancher: Command injection in Git package	Exploitation statusNot known exploited	FixYes	Published02/07/2023	SeverityHigh
`CVE-2022-43757`Rancher: Exposure of sensitive fields	Exploitation statusNot known exploited	FixYes	Published02/07/2023	SeverityCritical
`CVE-2022-31249`[RANCHER] OS command injection in Rancher and Fleet	Exploitation statusNot known exploited	FixNot confirmed	Published02/07/2023	SeverityHigh
`CVE-2022-31247`Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)	Exploitation statusNot confirmed	FixYes	Published09/07/2022	SeverityCritical
`CVE-2021-36783`Rancher: Failure to properly sanitize credentials in cluster template answers	Exploitation statusNot confirmed	FixYes	Published09/07/2022	SeverityCritical
`CVE-2021-36782`Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object	Exploitation statusNot confirmed	FixYes	Published09/07/2022	SeverityCritical
`CVE-2022-21951`Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden	Exploitation statusNot confirmed	FixYes	Published05/25/2022	SeverityMedium
`CVE-2021-4200`Write access to the Catalog for any user when restricted-admin role is enabled	Exploitation statusNot confirmed	FixYes	Published05/02/2022	SeverityMedium
`CVE-2021-36784`Privilege escalation for users with create/update permissions in Global Roles	Exploitation statusNot confirmed	FixYes	Published05/02/2022	SeverityHigh
`CVE-2021-36778`Exposure of repository credentials to external third-party sources	Exploitation statusNot confirmed	FixYes	Published05/02/2022	SeverityHigh
`CVE-2021-36776`Steve API proxy impersonation	Exploitation statusNot confirmed	FixYes	Published04/01/2022	SeverityHigh
`CVE-2021-36775`Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings	Exploitation statusNot confirmed	FixYes	Published04/01/2022	SeverityHigh
`CVE-2022-21947`rancher desktop: Dashboard API is network accessible	Exploitation statusNot confirmed	FixYes	Published04/01/2022	SeverityHigh
`CVE-2021-32001`K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token	Exploitation statusNot confirmed	FixNot confirmed	Published07/28/2021	SeverityMedium
`CVE-2021-25313`Rancher: XSS on /v3/cluster/	Exploitation statusNot confirmed	FixYes	Published03/05/2021	SeverityHigh
`CVE-2019-13209`	Exploitation statusNot confirmed	FixNot confirmed	Published09/04/2019	SeverityUnknown
`CVE-2019-11202`	Exploitation statusNot confirmed	FixNot confirmed	Published07/30/2019	SeverityUnknown
`CVE-2019-11881`	Exploitation statusNot confirmed	FixNot confirmed	Published06/10/2019	SeverityUnknown
`CVE-2019-12274`	Exploitation statusNot confirmed	FixNot confirmed	Published06/06/2019	SeverityUnknown
`CVE-2019-12303`	Exploitation statusNot confirmed	FixNot confirmed	Published06/06/2019	SeverityUnknown
`CVE-2019-6287`	Exploitation statusNot confirmed	FixNot confirmed	Published04/10/2019	SeverityUnknown
`CVE-2018-20321`	Exploitation statusNot confirmed	FixNot confirmed	Published04/10/2019	SeverityUnknown
`CVE-2017-7297`	Exploitation statusNot confirmed	FixYes	Published03/29/2017	SeverityUnknown

88 / 88 Results

All vulnerabilities loaded

Security vulnerabilities in rancher

rancher

How many security vulnerabilities does rancher currently have?

Does the latest version of rancher have any known vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management