Rancher

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:rancher:rancher:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorRancher (d9346c87-5425-5d08-9ca2-b6134f26cf8c)
ProductRancher (ed574b2c-31a9-5580-903c-ad662a6138df)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/rancher/rancher purl2cpe 2026-06-01 10:18:17.690812
pkg:sourceforge/rancher.mirror purl2cpe 2026-06-01 10:18:17.690813

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2023-32196 vulnerable 2026-06-08 06:04:45.125470 Rancher's External RoleTemplates can lead to privilege escalation
MEDIUM (6.6)
A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific scenarios can lead to privilege escalation.
Published: 2024-10-16T13:01:47.230Z
Updated: 2024-10-16T16:00:35.764Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-32194 vulnerable 2026-06-08 06:04:45.124221 Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'
HIGH (7.2)
A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will receive * permissions for core namespaces. This can lead to someone being capable of accessing, creating, updating, or deleting a namespace in the project.
Published: 2024-10-16T12:56:37.617Z
Updated: 2024-10-16T17:25:32.070Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-22649 vulnerable 2026-06-08 05:54:26.686289 Rancher 'Audit Log' leaks sensitive information
HIGH (8.4)
A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only deployments that have it enabled and have [AUDIT_LEVEL](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels) set to `1 or above` are impacted by this issue.
Published: 2024-10-16T07:46:50.610Z
Updated: 2024-10-16T17:26:00.938Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-36776 vulnerable 2026-06-08 05:32:52.511671 Steve API proxy impersonation
HIGH (8.8)
A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users. This issue affects: SUSE Rancher Rancher versions prior to 2.5.10.
Published: 2022-04-01T07:40:13.289Z
Updated: 2024-09-17T01:51:56.723Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-36775 vulnerable 2026-06-08 05:32:52.511134 Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings
HIGH (8.8)
a Improper Access Control vulnerability in SUSE Rancher allows users to keep privileges that should have been revoked. This issue affects: SUSE Rancher Rancher versions prior to 2.4.18; Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3.
Published: 2022-04-01T07:40:11.706Z
Updated: 2024-09-16T18:34:57.999Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-31999 vulnerable 2026-06-08 05:31:54.557085 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-25320 vulnerable 2026-06-08 05:30:40.660968 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-25318 vulnerable 2026-06-08 05:30:40.660204 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.