github.com/rancher/rancher vulnerabilities

CVEs whose affected-version data names the github.com/rancher/rancher package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

24 CVEsRSS

CVE-2024-22031High· 8.5

1w ago

A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster

A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user g…

github.com/rancher/rancher vulnerabilities

A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster

Rancher vulnerable to command injection through unsanitized YAML parameter

Rancher has over-inclusive team membership expansion in GitHub App authentication provider

Rancher has Privilege Escalation from Project Owner to Host

Rancher Extensions have arbitrary file access via path traversal

Rancher cloud credentials can be used through proxy API by users without access

Rancher's weave CNI password is not configured when a cluster is created from an RKE template

Rancher's Azure AD permission changes are not reflected on active sessions

Rancher doesn't properly sanitize credentials in cluster template answers

Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

Rancher's SAML-based login via CLI can be denied by unauthenticated users

Rancher UI has Stored Cross-site Scripting vulnerability

Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists

Rancher's Failure to delete orphaned role bindings does not revoke project level access from group based authentication

Rancher Privilege escalation vulnerability via malicious "Connection" header

Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources

Rancher vulnerable to Privilege Escalation via manipulation of Secrets

Rancher users retain access after moving namespaces into projects they don't have access to

Rancher UI has multiple Cross-Site Scripting (XSS) issues

Rancher Webhook is misconfigured during upgrade process

Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials

Rancher Privilege Escalation Vulnerability

Rancher Cross-site Scripting Vulnerability

Exposure of SSH credentials in Rancher/Fleet