CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,437
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product suse:rancher. Show all products

21 CVEs, showing 1 to 21
CVESeverityTitlePublished
CVE-2024-22031High 8.5Rancher users who can create Projects can gain access to arbitrary projects
Assigned by suse
Oct 15, 2026
CVE-2026-88804Critical 9.6Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher
Assigned by suse
Sep 28, 2026
CVE-2026-88805High 8.1Session Not Revoked Server-Side on Logout in Rancher
Assigned by suse
Sep 28, 2026
CVE-2026-88808High 8.8Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters
Assigned by suse
Sep 28, 2026
CVE-2026-93540Medium 6.5Fleet applies namespace labels and annotations without the bundle's service account privileges
Assigned by suse
Sep 28, 2026
CVE-2026-93539Medium 5.4Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver
Assigned by suse
Sep 28, 2026
CVE-2026-93538High 7.1Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet
Assigned by suse
Sep 28, 2026
CVE-2026-93537Medium 6.5Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory
Assigned by suse
Sep 28, 2026
CVE-2026-75035High 7.7Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass
Assigned by suse
Sep 3, 2026
CVE-2026-75034High 7.4Rancher: SAML Assertion Replay
Assigned by suse
Sep 3, 2026
CVE-2026-75033High 7.7Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing
Assigned by suse
Sep 3, 2026
CVE-2026-71404High 8.7Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole
Assigned by suse
Sep 3, 2026
CVE-2026-71403Medium 6.1Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind
Assigned by suse
Sep 3, 2026
CVE-2026-44945Critical 9.1Cross-Cluster Impersonation Confused-Deputy Privilege Escalation
Assigned by suse
Aug 5, 2026
CVE-2026-55998Medium 5.3Cluster Existence Oracle via Unauthenticated Import Endpoint
Assigned by suse
Aug 5, 2026
CVE-2026-59675High 7.5Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service
Assigned by suse
Aug 5, 2026
CVE-2026-55996Medium 4.3Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent
Assigned by suse
Aug 5, 2026
CVE-2026-44946High 7.4A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially allowing person in the middle attacks agai…Jun 30, 2026
CVE-2026-41053High 8.8Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2…Jun 30, 2026
CVE-2026-41052High 8.8Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.Jun 29, 2026
CVE-2025-67601Medium 4.8A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login command without also passing the –cacert…Feb 25, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.