CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 0CVE-2024-52282 – Rancher Helm Applications may have sensitive values leaked
https://notcve.org/view.php?id=CVE-2024-52282
11 Apr 2025 — A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps Catalog to read any sensitive information that are contained within the Apps’ values. Additionally, the same information leaks into auditing logs when the audit level is set to equal or above 2. This issue affects rancher: from 2.8.0 before 2.8.10, from 2.9.0 before 2.9.4. • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52282 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-23391 – Rancher: Restricted Administrator can change Administrator's passwords
https://notcve.org/view.php?id=CVE-2025-23391
11 Apr 2025 — A Incorrect Privilege Assignment vulnerability in SUSE rancher allows a Restricted Administrator to change the password of Administrators and take over their accounts. This issue affects rancher: from 2.8.0 before 2.8.14, from 2.9.0 before 2.9.8, from 2.10.0 before 2.10.4. • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23391 • CWE-266: Incorrect Privilege Assignment •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2025-23387 – Rancher's SAML-based login via CLI can be denied by unauthenticated users
https://notcve.org/view.php?id=CVE-2025-23387
27 Feb 2025 — A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3. Rancher's SAML-based login via CLI can be denied by unauthenticated users • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23387 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-23388 – Unauthenticated stack overflow in /v3-public/authproviders API
https://notcve.org/view.php?id=CVE-2025-23388
27 Feb 2025 — A Stack-based Buffer Overflow vulnerability in SUSE rancher allows for denial of service.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3. Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23388 • CWE-121: Stack-based Buffer Overflow •
CVSS: 8.4EPSS: 0%CPEs: 3EXPL: 0CVE-2025-23389 – Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login
https://notcve.org/view.php?id=CVE-2025-23389
27 Feb 2025 — A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3. Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23389 • CWE-284: Improper Access Control •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-45157 – Exposure of vSphere's CPI and CSI credentials in Rancher
https://notcve.org/view.php?id=CVE-2022-45157
13 Nov 2024 — A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments. • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2022-45157 • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-22032 – Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec
https://notcve.org/view.php?id=CVE-2024-22032
16 Oct 2024 — A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling, the Kube API secret values are written in plaintext on the AppliedSpec. Cluster owners, Cluster members, and Project members (for projects within the cluster), all have RBAC permissions to view the cluster object from the apiserver. Se ha identificado una vulnerabilidad en la que un clúster RKE1 se reconcilia constantemente cuando se habilita la config... • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22032 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-22030 – Rancher agents can be hijacked by taking over the Rancher Server URL
https://notcve.org/view.php?id=CVE-2024-22030
16 Oct 2024 — A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability. The targeted domain is the one used as the Rancher URL. Se ha identificado una vulnerabilidad en Rancher que puede explotarse en circunstancias específicas mediante un ataque de intermediario (MITM). Un atacante tendría... • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22030 • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-32196 – Rancher's External RoleTemplates can lead to privilege escalation
https://notcve.org/view.php?id=CVE-2023-32196
16 Oct 2024 — A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific scenarios can lead to privilege escalation. Se ha identificado una vulnerabilidad por la cual las comprobaciones de escalada de privilegios no se aplican correctamente para los objetos RoleTemplate cuando external=true, lo que en escenarios específicos puede provocar una escalada de privilegios. • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32196 • CWE-269: Improper Privilege Management •
CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2023-32194 – Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'
https://notcve.org/view.php?id=CVE-2023-32194
16 Oct 2024 — A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will receive * permissions for core namespaces. This can lead to someone being capable of accessing, creating, updating, or deleting a namespace in the project. Se ha identificado una vulnerabilidad al otorgar un rol de creación o * global para un tipo de recurso de "espacios de nombres"; sin importar el grupo de API, el sujeto recibirá * permisos para espacio... • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32194 • CWE-269: Improper Privilege Management •