CVE-2021-36778

CVE-2021-36778 describes an information/exposure risk in SUSE Rancher where administrators of third‑party repositories can gather credentials sent to Rancher servers due to an Incorrect Authorization flaw. Affected versions are Rancher prior to 2.5.12 and prior to 2.6.3. The issue enables credent...

CVE-2021-36784

CVE-2021-36784 describes an Improper Privilege Management vulnerability in SUSE Rancher where users with the restricted-admin role can escalate to full admin. Affected are Rancher releases prior to 2.5.13 (and prior to 2.6.4 for the 2.6 line). The issue arises from how Global Roles can be edited/...

CVE-2021-4200

CVE-2021-4200 in SUSE Rancher is an improper privilege management issue that lets any user with catalog access write to CatalogTemplates and CatalogTemplateVersions when the restricted-admin role is enabled. Affected Rancher versions are prior to 2.5.13 and prior to 2.6.4; patched releases are 2....

CVE-2021-25313

CVE-2021-25313 is a Cross-site Scripting vulnerability in SUSE Rancher (Rancher) prior to version 2.5.6. The root cause is improper neutralization of input during web page generation, allowing remote attackers to execute JavaScript via malicious links. Exploitation details are not provided in the...

CVE-2026-75034

CVE-2026-75034 is a SAML assertion replay flaw in Rancher Manager affecting versions before 2.15.1 (also patched in 2.14.5 and 2.13.9). The replay protection introduced to fix CVE-2026-44946 stored consumed assertion IDs in a per-process cache , so in high-availability deployments each replica on...

CVE-2026-75035

SUSE Rancher Manager is affected by a flaw in the ext.cattle.io/v1 Token store where a crafted label selector causes the internal owner filter to be dropped, allowing any authenticated user (with the built-in User or User Base role) to list and watch other users' tokens. Exposed data includes tok...

CVE-2026-75033

CVE-2026-75033 is a cross-cluster secret leakage vulnerability in Rancher Manager (before 2.15.1 ). Project Secrets were propagated into a namespace based solely on the field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. An ...

CVE-2026-71403

CVE-2026-71403 affects Rancher Manager before version 2.15.1 . The flaw resides in the /v3/users update path, which failed to enforce immutability of the username and principalIds fields on a User resource. An attacker holding the update verb on users.management.cattle.io could inject a foreign i...

CVE-2026-71404

Rancher Manager (before 2.15.1 ) contains a flaw in the GlobalRole controller , which derived the target ClusterRole name from the user-settable authz.management.cattle.io/cr-name annotation and overwrote that object's rules without verifying ownership. An attacker with delegated GlobalRole creat...