What’s Vulnerable › Products

SUSE Rancher vulnerabilities

70 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 40 published in the last 12 months.

Check whether your SUSE Rancher version is affected

Latest SUSE Rancher vulnerabilities

• CVE-2026-104623 — Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster (CVSS 6.3)
• CVE-2026-104615 — Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace (CVSS 7.9)
• CVE-2024-22031 — Rancher users who can create Projects can gain access to arbitrary projects (CVSS 8.5)
• CVE-2026-88805 — Session Not Revoked Server-Side on Logout in Rancher (CVSS 8.1)
• CVE-2026-88804 — Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher (CVSS 9.6)
• CVE-2026-75035 — Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass (CVSS 6.5)
• CVE-2026-75034 — Rancher: SAML Assertion Replay (CVSS 7.4)
• CVE-2026-75033 — Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing (CVSS 7.7)
• CVE-2026-71404 — Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole (CVSS 8.7)
• CVE-2026-71403 — Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind (CVSS 6.1)
• CVE-2026-44945 — Cross-Cluster Impersonation Confused-Deputy Privilege Escalation (CVSS 9.1)
• CVE-2026-59675 — Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service (CVSS 7.5)
• CVE-2026-55998 — Cluster Existence Oracle via Unauthenticated Import Endpoint (CVSS 5.3)
• CVE-2026-55996 — Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent (CVSS 4.3)
• CVE-2026-44934 — Exposed tokens in SUSE Rancher AI Agent logs (CVSS 7.0)
• CVE-2026-44949 — Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook (CVSS 7.0)
• CVE-2026-44947 — Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher (CVSS 6.9)
• CVE-2026-44946 — SAML Authentication Replay in Rancher (CVSS 7.4)
• CVE-2026-41053 — Over-inclusive team membership expansion in GitHub App authentication provider for Rancher (CVSS 8.8)
• CVE-2026-41052 — Rancher Privilege Escalation from Project Owner to Host (CVSS 8.8)
• CVE-2026-44939 — Command injection through unsanitized YAML parameter in Rancher (CVSS 9.4)
• CVE-2026-25705 — Rancher Extensions have arbitrary file access via path traversal (CVSS 8.4)
• CVE-2025-67601 — Rancher CLI skips TLS verification on Rancher CLI login command (CVSS 4.8)
• CVE-2025-62878 — Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern (CVSS 9.9)
• CVE-2024-58269 — Rancher exposes sensitive information through audit logs (CVSS 4.3)