RA
Product
rancher
61
CVEs
0
On KEV
9.9
Max CVSS
5
New 30D
Severity mix
Critical 12High 30Medium 19Low 0
Watch
Add rancher to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44947 | 6.9 | Jun 30 | Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher Affected: 2.13.0 before 2.13.7; 2.14.0 before 2.14.3 |
| CVE-2022-43758 | 6.8 | Feb 7 | A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add… Affected: 2.5.0 before 2.5.17; 2.6.0 before 2.6.10; 2.7.0 before 2.7.1 |
| CVE-2022-21951 | 6.8 | May 25 | A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption… Affected: 2.5.0 before 2.5.14; 2.6.0 before 2.6.5 |
| CVE-2026-93540 | 6.5 | Sep 28 | Fleet applies namespace labels and annotations without the bundle's service account privileges Affected: 0.16.0 before 0.16.1; 0.15.0 before 0.15.7; 0.14.0 before 0.14.11; 0.13.0 before 0.13.16 |
| CVE-2026-93537 | 6.5 | Sep 28 | Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory Affected: 0.16.0 before 0.16.2; 0.15.0 before 0.15.7; 0.14.0 before 0.14.11; 0.13.0 before 0.13.16; 0.12.0 before 0.12.20 |
| CVE-2026-75035 | 6.5 | Sep 3 | Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass Affected: before 2.15.1 |
| CVE-2023-22649 | 6.5 | Oct 16 | A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs Affected: 2.6.0 before 2.6.14; 2.7.0 before 2.7.10; 2.8.0 before 2.8.2 |
| CVE-2026-71403 | 6.1 | Sep 3 | Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind Affected: before 2.15.1 |
| CVE-2021-25313 | 6.1 | Mar 5 | A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote attackers to execute JavaScript via malicious links Affected: before 2.5.6 |
| CVE-2019-13209 | 6.1 | Sep 4 | Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher Affected: 2.0.0 through 2.2.4 |
| CVE-2026-93539 | 5.4 | Sep 28 | Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver Affected: 0.16.0 before 0.16.2 |
| CVE-2021-4200 | 5.4 | May 2 | A Improper Privilege Management vulnerability in SUSE Rancher allows write access to the Catalog for any user when restricted-admin role is enabled Affected: before 2.5.13; 2.6.0 before 2.6.4 |
| CVE-2026-55998 | 5.3 | Aug 5 | Cluster Existence Oracle via Unauthenticated Import Endpoint Affected: 2.14.0 before 2.14.4; 2.13.0 before 2.13.8; 2.12.0 before 2.12.12; 2.11.0 before 2.11.16 |
| CVE-2026-44936 | 5.0 | Jul 6 | Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml Affected: 0.15.0 before 0.15.2; 0.14.0 before 0.14.6; 0.13.0 before 0.13.11; 0.12.0 before 0.12.15 |
| CVE-2026-44948 | 4.9 | Jun 30 | Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler Affected: 0.12.0 before 0.12.16; 0.13.0 before 0.13.12; 0.14.0 before 0.14.7; 0.15.0 before 0.15.3 |
| CVE-2025-62879 | 4.9 | Mar 4 | Rancher Backup Operator pod's logs leak S3 tokens Affected: 9.0.0 before 9.0.1; 8.0.0 before 8.1.2; 7.0.0 before 7.0.5; 6.0.0 before 6.0.3 |
| CVE-2025-67601 | 4.8 | Feb 25 | Rancher CLI skips TLS verification on Rancher CLI login command Affected: before 0.0.0-20260129092249-bb0625fd1896; 2.13.0 before 2.13.2; 2.12.0 before 2.12.6; 2.11.0 before 2.11.10; 2.10.0 before 2.10.11 |
| CVE-2019-11881 | 4.7 | Jun 10 | A vulnerability exists in Rancher before 2.2.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary content, filtering tags but not special… Affected: 2.1.4 |
| CVE-2026-55996 | 4.3 | Aug 5 | Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent Affected: 2.11.0 before 2.11.16; 2.12.0 before 2.12.12; 2.13.0 before 2.13.8; 2.14.0 before 2.14.4 |
Showing 19