CVE-2017-7297

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-03-29 · updated 2026-06-17

Description

Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. This is fixed in versions rancher/server:v1.2.4, rancher/server:v1.3.5, rancher/server:v1.4.3, and rancher/server:v1.5.3.

Affected products

SUSE Rancher: from 1.2.0 before 1.2.4; from 1.3.0 before 1.3.5; from 1.4.0 before 1.4.3; from 1.5.0 before 1.5.3 — fixed in 1.2.4, 1.3.5, 1.4.3, 1.5.3

How to fix

Upgrade to a fixed version: SUSE Rancher 1.2.4, 1.3.5, 1.4.3, 1.5.3. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/97180
https://github.com/rancher/rancher/issues/8296
http://www.securityfocus.com/bid/97180
https://github.com/rancher/rancher/issues/8296

Get alerted when CVE-2017-7297 or the next vulnerability affects your stack