Security Advisories for github.com/rancher/rancher in go
Critical
3 months ago
Rancher has Privilege Escalation from Project Owner to Host
go
github.com/rancher/rancher
High
3 months ago
Rancher has over-inclusive team membership expansion in GitHub App authentication provider
go
github.com/rancher/rancher
Critical
3 months ago
Rancher vulnerable to command injection through unsanitized YAML parameter
go
github.com/rancher/rancher
High
5 months ago
Rancher Extensions have arbitrary file access via path traversal
go
github.com/rancher/rancher
Critical
7 months ago
Rancher cloud credentials can be used through proxy API by users without access
go
github.com/rancher/rancher
High
7 months ago
Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user
go
github.com/rancher/rancher
Moderate
7 months ago
Rancher's weave CNI password is not configured when a cluster is created from an RKE template
go
github.com/rancher/rancher
Critical
7 months ago
Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)
go
github.com/rancher/rancher
Critical
7 months ago
Rancher doesn't properly sanitize credentials in cluster template answers
go
github.com/rancher/rancher
High
7 months ago
Rancher's Azure AD permission changes are not reflected on active sessions
go
github.com/rancher/rancher
High
8 months ago
Rancher CLI skips TLS verification on Rancher CLI login command
go
github.com/rancher/rancher
Moderate
12 months ago
Rancher exposes sensitive information through audit logs
go
github.com/rancher/rancher
Moderate
12 months ago
Rancher user retains access to clusters despite Global Role removal
go
github.com/rancher/rancher
High
about 1 year ago
Rancher update on users can deny the service to the admin
go
github.com/rancher/rancher
High
about 1 year ago
Rancher CLI SAML authentication is vulnerable to phishing attacks
go
github.com/rancher/rancher
Moderate
about 1 year ago
Rancher sends sensitive information to external services through the `/meta/proxy` endpoint
go
github.com/rancher/rancher
High
about 1 year ago
Rancher affected by unauthenticated Denial of Service
go
github.com/rancher/rancher
High
over 1 year ago
Rancher users who can create Projects can gain access to arbitrary projects
go
github.com/rancher/rancher
Critical
over 1 year ago
Rancher: Restricted Administrator can change Administrator's passwords
go
github.com/rancher/rancher
High
over 1 year ago
Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login
go
github.com/rancher/rancher
High
over 1 year ago
Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API
go
github.com/rancher/rancher
Moderate
over 1 year ago
Rancher's SAML-based login via CLI can be denied by unauthenticated users
go
github.com/rancher/rancher
High
over 1 year ago
Rancher UI has Stored Cross-site Scripting vulnerability
go
github.com/rancher/rancher
Moderate
almost 2 years ago
Rancher Helm Applications may have sensitive values leaked
go
github.com/rancher/rancher
Potential
Critical
almost 2 years ago
RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists
go
github.com/rancher/rke2
Critical
almost 2 years ago
Rancher Remote Code Execution via Cluster/Node Drivers
go
github.com/rancher/rancher
High
almost 2 years ago
Exposure of vSphere's CPI and CSI credentials in Rancher
go
github.com/rancher/rancher
Critical
almost 2 years ago
Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists
go
github.com/rancher/rancher
High
about 2 years ago
Rancher agents can be hijacked by taking over the Rancher Server URL
go
github.com/rancher/rancher
High
over 2 years ago
Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec
go
github.com/rancher/rancher
High
over 2 years ago
Rancher's External RoleTemplates can lead to privilege escalation
go
github.com/rancher/rancher
High
over 2 years ago
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider
go
github.com/rancher/rancher
High
over 2 years ago
Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources
go
github.com/rancher/rancher
High
over 2 years ago
Rancher Privilege escalation vulnerability via malicious "Connection" header
go
github.com/rancher/rancher
High
over 2 years ago
Rancher's Steve API Component Improper authorization check allows privilege escalation
go
github.com/rancher/rancher
High
over 2 years ago
Rancher's Failure to delete orphaned role bindings does not revoke project level access from group based authentication
go
github.com/rancher/rancher
High
over 2 years ago
Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'
go
github.com/rancher/rancher
Critical
over 3 years ago
Rancher vulnerable to Privilege Escalation via manipulation of Secrets
go
github.com/rancher/rancher
Moderate
over 3 years ago
Rancher UI has multiple Cross-Site Scripting (XSS) issues
go
github.com/rancher/rancher
High
over 3 years ago
Rancher users retain access after moving namespaces into projects they don't have access to
go
github.com/rancher/rancher
Critical
over 3 years ago
Rancher Webhook is misconfigured during upgrade process
go
github.com/rancher/rancher
High
over 3 years ago
Rancher generated tokens not revoked after modifications made to authentication provider
go
github.com/rancher/rancher
High
over 3 years ago
Plaintext storage of sensitive data in Rancher API and cluster.management.cattle.io objects
go
github.com/rancher/rancher
High
over 3 years ago
Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster
go
github.com/rancher/rancher
High
over 3 years ago
Privilege escalation in project role template binding (PRTB) and -promoted roles
go
github.com/rancher/rancher
Critical
about 4 years ago
Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials
go
github.com/rancher/rancher
Critical
over 4 years ago
Rancher Recreates Default User With Known Password Despite Deletion
go
github.com/rancher/rancher
High
over 4 years ago
Rancher code injection via fluentd config commands
go
github.com/rancher/rancher
High
over 4 years ago
Rancher Project Members Have Continued Access to Namespaces After Being Removed From Them
go
github.com/rancher/rancher
Moderate
over 4 years ago
Privilege escalation for users with create/update permissions in Global Roles in Rancher
go
github.com/rancher/rancher
High
over 4 years ago
Exposure of repository credentials to external third-party sources in Rancher
go
github.com/rancher/rancher
High
over 4 years ago
Write access to the catalog for any user when restricted-admin role is enabled in Rancher
go
github.com/rancher/rancher
High
over 5 years ago
Rancher Vulnerable to Cross-site Request Forgery (CSRF)
go
github.com/rancher/rancher