Vulnerabilities of SUSE Rancher
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-88811 | Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud… | 9.1 Critical | Nov 2, 2026 |
| CVE-2026-94290 | SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent… | 9.1 Critical | Nov 2, 2026 |
| CVE-2026-88804 | An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site… | 9.6 Critical | Sep 28, 2026 |
| CVE-2026-44945 | A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go) | 9.1 Critical | Aug 5, 2026 |
| CVE-2026-44935 | Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before… | 9.9 Critical | Jul 2, 2026 |
| CVE-2026-44946 | A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce … | 9.5 Critical | Jun 30, 2026 |
| CVE-2026-41052 | Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher… | 9.4 Critical | Jun 29, 2026 |
| CVE-2026-44939 | Command injection through unsanitized YAML parameter in Rancher | 9.4 Critical | Jun 19, 2026 |
| CVE-2026-41050 | Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git… | 9.9 Critical | May 13, 2026 |
| CVE-2025-62878 | A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the… | 9.9 Critical | Feb 25, 2026 |
| CVE-2024-22036 | A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail… | 9.1 Critical | Apr 16, 2025 |
| CVE-2025-23391 | A Incorrect Privilege Assignment vulnerability in SUSE rancher allows a Restricted Administrator to change the… | 9.1 Critical | Apr 11, 2025 |
| CVE-2022-45157 | A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI… | 9.1 Critical | Nov 13, 2024 |
| CVE-2023-22647 | An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing… | 9.9 Critical | Jun 1, 2023 |
| CVE-2023-22651 | Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation | 9.9 Critical | May 4, 2023 |
| CVE-2022-43757 | A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain… | 9.9 Critical | Feb 7, 2023 |
| CVE-2022-31247 | An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role… | 9.1 Critical | Sep 7, 2022 |
| CVE-2021-36783 | A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster… | 9.9 Critical | Sep 7, 2022 |
| CVE-2021-36782 | A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners,… | 9.9 Critical | Sep 7, 2022 |
Other SUSE products
neuvector 14
openSUSE Tumbleweed 13
SUSE Linux Enterprise Server 15 13
SUSE Linux Enterprise Server 12 12
SUSE Linux Enterprise Server for SAP 15 8
libzypp 7
SUSE Linux Enterprise Server 15-LTSS 7
SUSE Manager Server Module 4.3 7
SUSE Linux Enterprise Server for SAP Applications 15 SP6 6
supportutils 5
openSUSE Factory 5
SUSE Linux Enterprise Server for SAP Applications 15 SP5 5