GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: trivy, kgateway, newrelic-infrastructure-agent, helm-operator-fips, spegel-fips, grype, chaos-mesh-fips, k9s, grype-fips, skaffold-fips, helm-operator, kube-arangodb, scorecard, kots, trivy-fips, newrelic-infrastructure-agent-fips, docker-compose-fips,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: trivy, kgateway, newrelic-infrastructure-agent, helm-operator-fips, spegel-fips, grype, chaos-mesh-fips, k9s, grype-fips, skaffold-fips, helm-operator, kube-arangodb, scorecard, kots, trivy-fips, newrelic-infrastructure-agent-fips, docker-compose-fips,...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: trivy, kgateway, newrelic-infrastructure-agent, helm-operator-fips, spegel-fips, grype, chaos-mesh-fips, k9s, grype-fips, skaffold-fips, helm-operator, kube-arangodb, scorecard, kots, trivy-fips, newrelic-infrastructure-agent-fips, docker-compose-fips,...

CVE-2026-47262 vulnerabilities

Vulnerabilities for packages: trivy, kgateway, newrelic-infrastructure-agent, helm-operator-fips, spegel-fips, grype, chaos-mesh-fips, k9s, grype-fips, skaffold-fips, helm-operator, kube-arangodb, scorecard, kots, trivy-fips, newrelic-infrastructure-agent-fips, docker-compose-fips,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: k9s, docker-cli-buildx, ctop, kubevela, headlamp, buildkitd, k8sgpt, rancher-helm, helm-mapkubeapis, steampipe, manifest-tool, chartmuseum, rancher, docker-compose, rancher-agent, neuvector-scanner, envoy-gateway, trivy, newrelic-infrastructure-agent, zot,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: k9s, docker-cli-buildx, ctop, kubevela, headlamp, buildkitd, k8sgpt, rancher-helm, helm-mapkubeapis, steampipe, manifest-tool, chartmuseum, rancher, docker-compose, rancher-agent, neuvector-scanner, envoy-gateway, trivy, newrelic-infrastructure-agent, zot,...

CVE-2026-47262 vulnerabilities

Vulnerabilities for packages: k9s, docker-cli-buildx, ctop, kubevela, headlamp, buildkitd, k8sgpt, rancher-helm, helm-mapkubeapis, steampipe, manifest-tool, chartmuseum, rancher, docker-compose, rancher-agent, neuvector-scanner, envoy-gateway, trivy, newrelic-infrastructure-agent, zot,...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: k9s, docker-cli-buildx, ctop, kubevela, headlamp, buildkitd, k8sgpt, rancher-helm, helm-mapkubeapis, steampipe, manifest-tool, chartmuseum, rancher, docker-compose, rancher-agent, neuvector-scanner, envoy-gateway, trivy, newrelic-infrastructure-agent, zot,...

CVE-2026-44939

A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/tokenclusterId.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers...

CVE-2026-44939 Command injection through unsanitized YAML parameter in Rancher

A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/tokenclusterId.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers...

CVE-2026-44939

An input validation flaw in Rancher Manager's import endpoint (/v3/import/{token}_{clusterId}.yaml) allows command injection via unsanitized YAML parameters in versions prior to 2.14.2. Impact: remote attackers could break out of the container image and execute arbitrary code inside containers. R...

CVE-2025-71261

An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a security control...

CVE-2025-71261

The CVE-2025-71261 issue affects the SUSE Virtualization (Harvester) Rancher integration registration client, specifically the cluster-registration-url path. The root cause is an insecure TLS setup that fails to verify the remote server’s certificate, enabling MITM between SUSE Virtualization and...

EUVD-2025-210170

An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a security control...

CLEANSTART-2026-OK35650 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

Multiple security vulnerabilities affect the rancher-agent package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed...

K000161495: Rancher Local Path Provisioner vulnerability CVE-2025-62878

Security Advisory Description A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories. CVE-2025-62878 Impact There is no impact; F5 products...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: k9s, docker-cli-buildx, ctop, kubevela, opa, headlamp, buildkitd, k8sgpt, gogatekeeper, helm-mapkubeapis, rancher-helm, steampipe, manifest-tool, chartmuseum, rancher, docker-compose, rancher-agent, neuvector-scanner, envoy-gateway, trivy,...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: k9s, docker-cli-buildx, ctop, kubevela, opa, headlamp, buildkitd, k8sgpt, gogatekeeper, helm-mapkubeapis, rancher-helm, steampipe, manifest-tool, chartmuseum, rancher, docker-compose, rancher-agent, neuvector-scanner, envoy-gateway, trivy,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: trivy, newrelic-infrastructure-agent, helm-operator-fips, spegel-fips, grype, chaos-mesh-fips, k9s, grype-fips, skaffold-fips, helm-operator, osv-scanner, kube-arangodb, scorecard, kots, k8ssandra-client, trivy-fips, newrelic-infrastructure-agent-fips,...

Improper Certificate Validation

rancher is vulnerable to Improper Certificate Validation. The vulnerability is due to the Rancher CLI automatically retrieving and trusting CA certificates from Rancher’s cacerts setting when the -skip-verify flag is used without the --cacert flag, potentially allowing attackers to influence...