Skip to content
OpenAdvisories

Vendor

rancher

5 known vulnerabilities.

Products

rancher 4 local-path-provisioner 1 SUSE Linux Enterprise Server 15 1 Rancher < 2.5.17 0 Rancher < 2.6.10 0 Rancher < 2.7.1 0 Rancher 2.7.3 0
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.8
    CVE-2026-55997

    Long-lived Rancher registration token exposed in plaintext

    Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, store…

    rancher rancher
  • High 8.7
    CVE-2026-44543

    Local Path Provisioner: HelperPod Template Injection

    Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPo…

    rancher local-path-provisioner github.com/rancher/local-path-provisioner Go
  • High 8.8
    CVE-2021-31999

    Rancher: Privilege escalation vulnerability via malicious Connection header

    A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.…

    rancher rancher SUSE Linux Enterprise Server 15 github.com/rancher/rancher Linux Go
  • High 8.8
    CVE-2021-25318

    rancher: API group not properly specified when creating Kubernetes RBAC resources

    A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to. This issue affects: Rancher versions prior to 2.5.9 ; Rancher versions prior to 2.4.16.

    rancher rancher github.com/rancher/rancher Go