Suse Rancher
72 CVEs affecting Suse Rancher. Latest disclosed: 2026-07-07. Critical: 13, High: 38.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44935 | Critical | 9.9 | 2026-07-02 | Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 befor… |
CVE-2026-41050 | Critical | 9.9 | 2026-05-13 | Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repositor… |
CVE-2025-62878 | Critical | 9.9 | 2026-02-25 | A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensiti… |
CVE-2023-22647 | Critical | 9.9 | 2023-06-01 | An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets i… |
CVE-2023-22651 | Critical | 9.9 | 2023-05-04 | Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead… |
CVE-2022-43757 | Critical | 9.9 | 2023-02-07 | A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends o… |
CVE-2021-36783 | Critical | 9.9 | 2022-09-07 | A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members t… |
CVE-2021-36782 | Critical | 9.9 | 2022-09-07 | A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Member… |
CVE-2019-11202 | Critical | 9.8 | 2019-07-30 | An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher s… |
CVE-2024-22036 | Critical | 9.1 | 2025-04-16 | A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root access to the Rancher co… |
CVE-2025-23391 | Critical | 9.1 | 2025-04-11 | A Incorrect Privilege Assignment vulnerability in SUSE rancher allows a Restricted Administrator to change the password of Administrators and take over their a… |
CVE-2022-45157 | Critical | 9.1 | 2024-11-13 | A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials u… |
CVE-2022-31247 | Critical | 9.1 | 2022-09-07 | An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role temp… |
CVE-2024-52281 | High | 8.9 | 2025-04-16 | A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through th… |
CVE-2026-44938 | High | 8.8 | 2026-07-07 | A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleD… |
CVE-2026-41053 | High | 8.8 | 2026-06-30 | Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any log… |
CVE-2026-41052 | High | 8.8 | 2026-06-29 | Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6… |
CVE-2023-22650 | High | 8.8 | 2024-10-16 | A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider… |
CVE-2020-10676 | High | 8.8 | 2023-12-12 | In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move tha… |
CVE-2021-36776 | High | 8.8 | 2022-04-04 | A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users. This issue affects: SUSE Rancher Rancher versions… |