What’s Vulnerable › Vulnerabilities

CVE-2026-25705: Rancher Extensions have arbitrary file access via path traversal

• Severity: high (CVSS 8.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-13 · updated 2026-10-26
• Weakness: CWE-35

Description

A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to: * Overwrite Rancher binaries or configuration to inject code. * Write to /var/lib/rancher/ to tamper with cluster state. * If hostPath volumes are mounted, write to the host node filesystem. * Use this issue to chain with other attack vectors.

Affected products

• SUSE Rancher: from 2.14.0 before 2.14.1; from 2.13.0 before 2.13.5; from 2.12.0 before 2.12.9; from 2.10.11 before 2.11.13 — fixed in 2.11.13, 2.12.9, 2.13.5, 2.14.1

How to fix

Upgrade to a fixed version: SUSE Rancher 2.11.13, 2.12.9, 2.13.5, 2.14.1. Check the vendor advisory for mitigations.

References

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-25705
• https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35

Get alerted when CVE-2026-25705 or the next vulnerability affects your stack