SUSE Rancher

• CVE-2024-52280 High 7.7 Users can issue watch commands for arbitrary resources 0.5%
• CVE-2024-52282 Medium 6.2 Rancher Helm Applications may have sensitive values leaked 0.5%
• CVE-2025-23387 Medium 5.3 Rancher's SAML-based login via CLI can be denied by unauthenticated users 0.6%
• CVE-2025-23388 High 8.2 Unauthenticated stack overflow in /v3-public/authproviders API 0.6%
• CVE-2025-23389 High 8.4 Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login 0.5%
• CVE-2025-23391 Critical 9.1 Rancher: Restricted Administrator can change Administrator's passwords 0.5%
• CVE-2022-45157 Critical 9.1 Exposure of vSphere's CPI and CSI credentials in Rancher 0.4%
• CVE-2024-22032 Medium 6.5 Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec 0.4%
• CVE-2024-22030 High 8.0 Rancher agents can be hijacked by taking over the Rancher Server URL 0.4%
• CVE-2023-32196 Medium 6.6 Rancher's External RoleTemplates can lead to privilege escalation 0.6%
• CVE-2023-32194 High 7.2 Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' 0.4%
• CVE-2023-22650 High 8.8 Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider 0.6%
• CVE-2023-22649 High 8.4 Rancher 'Audit Log' leaks sensitive information 2.0%
• CVE-2022-43760 High 8.4 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is executed 0.7%
• CVE-2023-22647 Critical 9.9 An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the se 0.7%
• CVE-2023-22648 High 8.0 A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to 0.5%
• CVE-2023-22651 Critical 9.9 Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead to the misconfiguration of the Webhook. 0.8%
• CVE-2022-43757 Critical 9.9 Rancher: Exposure of sensitive fields 0.6%
• CVE-2022-31249 High 7.5 [RANCHER] OS command injection in Rancher and Fleet 3.8%
• CVE-2022-43755 High 7.1 Rancher: Non-random authentication token 1.7%
• CVE-2022-43758 High 7.6 Rancher: Command injection in Git package 1.0%
• CVE-2022-43759 High 7.2 Rancher: Privilege escalation via promoted roles 0.7%
• CVE-2022-43756 Medium 5.9 Rancher/Wrangler: Denial of service when processing Git credentials 0.7%
• CVE-2022-21953 High 7.4 Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster 0.5%
• CVE-2022-31247 Critical 9.1 Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB) 1.0%
• CVE-2021-36783 Critical 9.9 Rancher: Failure to properly sanitize credentials in cluster template answers 0.8%
• CVE-2021-36782 Critical 9.9 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object 4.2%
• CVE-2022-21951 Medium 6.8 Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden 0.4%
• CVE-2021-4200 Medium 5.4 Write access to the Catalog for any user when restricted-admin role is enabled 0.6%
• CVE-2021-36784 High 7.2 Privilege escalation for users with create/update permissions in Global Roles 0.9%
• CVE-2021-36778 High 7.3 Exposure of repository credentials to external third-party sources 0.8%
• CVE-2021-36776 High 8.8 Steve API proxy impersonation 1.1%
• CVE-2021-36775 High 8.8 Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings 1.0%
• CVE-2022-21947 High 8.3 rancher desktop: Dashboard API is network accessible 0.6%
• CVE-2021-32001 Medium 6.5 K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token 0.3%
• CVE-2021-25313 High 7.1 Rancher: XSS on /v3/cluster/ 1.5%