Known vulnerabilities in SUSE Rancher
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-44936 | Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle… | 5.0 Medium | Jul 6, 2026 |
| CVE-2026-44934 | A information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before 1.0.2 could leak API keys or LLM… | 7.0 High | Jul 6, 2026 |
| CVE-2026-44935 | Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before… | 9.9 Critical | Jul 2, 2026 |
| CVE-2026-44948 | A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up… | 5.3 Medium | Jun 30, 2026 |
| CVE-2026-44949 | A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook handler for versions 0.7.0… | 7.0 High | Jun 30, 2026 |
| CVE-2026-44947 | A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher versions 2.13.0 up to… | 6.9 Medium | Jun 30, 2026 |
| CVE-2026-44946 | A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce … | 9.5 Critical | Jun 30, 2026 |
| CVE-2026-41053 | Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider… | 8.8 High | Jun 30, 2026 |
| CVE-2026-41052 | Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher… | 9.4 Critical | Jun 29, 2026 |
| CVE-2026-44939 | Command injection through unsanitized YAML parameter in Rancher | 9.4 Critical | Jun 19, 2026 |
| CVE-2026-41050 | Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git… | 9.9 Critical | May 13, 2026 |
| CVE-2026-25705 | A vulnerability has been identified in [Rancher's… | 8.4 High | May 13, 2026 |
| CVE-2025-62879 | A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both… | 6.8 Medium | Mar 4, 2026 |
| CVE-2025-62878 | A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the… | 9.9 Critical | Feb 25, 2026 |
| CVE-2025-67601 | A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the… | 8.3 High | Feb 25, 2026 |
| CVE-2024-58269 | A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster… | 4.3 Medium | Oct 29, 2025 |
| CVE-2023-32199 | A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives … | 4.3 Medium | Oct 29, 2025 |
| CVE-2024-58260 | A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username`… | 7.6 High | Oct 2, 2025 |
| CVE-2024-58267 | A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is… | 8.0 High | Oct 2, 2025 |
| CVE-2025-54468 | A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an… | 4.7 Medium | Oct 2, 2025 |
| CVE-2024-58259 | A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on… | 8.2 High | Sep 2, 2025 |
| CVE-2024-52284 | Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources… | 7.7 High | Sep 2, 2025 |
| CVE-2023-32197 | A Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can… | 6.6 Medium | Apr 16, 2025 |
| CVE-2024-22036 | A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail… | 9.1 Critical | Apr 16, 2025 |
| CVE-2024-52281 | A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to… | 8.9 High | Apr 16, 2025 |
Other SUSE products
neuvector 14
openSUSE Tumbleweed 13
SUSE Linux Enterprise Server 15 13
SUSE Linux Enterprise Server 12 12
SUSE Linux Enterprise Server for SAP 15 8
libzypp 7
SUSE Linux Enterprise Server 15-LTSS 7
SUSE Manager Server Module 4.3 7
SUSE Linux Enterprise Server for SAP Applications 15 SP6 6
supportutils 5
openSUSE Factory 5
SUSE Linux Enterprise Server for SAP Applications 15 SP5 5