RA
Product
rancher
61
CVEs
0
On KEV
9.9
Max CVSS
5
New 30D
Severity mix
Critical 12High 30Medium 19Low 0
Watch
Add rancher to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44935 | 9.9 | Jul 2 | Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer Affected: 0.15.0 before 0.15.2; 0.14.0 before 0.14.6; 0.13.0 before 0.13.11; 0.12.0 before 0.12.15 |
| CVE-2026-41050 | 9.9 | May 13 | Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering Affected: 0.15.0 before 0.15.1; 0.14.0 before 0.14.5; 0.13.0 before 0.13.10; 0.12.0 before 0.12.14; 0.11.0 before 0.11.13 |
| CVE-2025-62878 | 9.9 | Feb 25 | Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern Affected: before 0.0.34 |
| CVE-2023-22651 | 9.9 | May 4 | Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation Affected: 2.6.0 through 2.7.2 |
| CVE-2021-36783 | 9.9 | Sep 7 | A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials,… Affected: 2.5.0 before 2.5.13; 2.6.0 before 2.6.4 |
| CVE-2021-36782 | 9.9 | Sep 7 | A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to… Affected: 2.5.0 before 2.5.16; 2.6.0 before 2.6.7 |
| CVE-2022-43755 | 9.8 | Feb 7 | A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed Affected: 2.6.0 before 2.6.10; 2.7.0 before 2.7.1 |
| CVE-2019-11202 | 9.8 | Jul 30 | An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1 Affected: 2.0.0 through 2.0.13; 2.1.0 through 2.1.8; 2.2.0 through 2.2.1 |
| CVE-2026-88804 | 9.6 | Sep 28 | Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher Affected: 2.15.0 before 2.15.2; 2.14.0 before 2.14.6; 2.13.0 before 2.13.10; 2.12.0 before 2.12.14; 2.11.0se before 2.11.18 |
| CVE-2026-44939 | 9.4 | Jun 19 | Command injection through unsanitized YAML parameter in Rancher Affected: 2.14.0 before 2.14.2; 2.13.0 before 2.13.6; 2.12.0 before 2.12.10; 2.11.0 before 2.11.14; 2.10.0 before 2.10.12 |
| CVE-2026-44945 | 9.1 | Aug 5 | Cross-Cluster Impersonation Confused-Deputy Privilege Escalation Affected: 2.11.0 before 2.11.16; 2.12.0 before 2.12.12; 2.13.0 before 2.13.8; 2.14.0 before 2.14.2 |
| CVE-2022-31247 | 9.1 | Sep 7 | An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role template bindings (such… Affected: 2.5.0 before 2.5.16; 2.6.0 before 2.6.7 |
Showing 12