Security Advisories and CVEs
Rancher is committed to informing the community of security issues in our products. Rancher will publish security advisories and CVEs (Common Vulnerabilities and Exposures) for issues we have resolved. New security advisories are also published in Rancher’s GitHub security page.
| ID | Description | Date | Resolution |
|---|---|---|---|
POSTs to the Rancher API endpoints are now limited to 1 Mi; this is configurable through the settings if you need a larger limit. The Rancher authentication endpoints are configured independently of the main public API (as you might need bigger payloads in the other API endpoints). Suppose you need to increase the maximum allowed payload for authentication. In that case, you can set the environment variable |
28 Aug 2025 |
||
Following a recent change excluding Helm values files from bundles, an edge case subsisted where the values files referenced in |
28 Aug 2025 |
||
This vulnerability only affects customers using Continuous Delivery with Fleet where Fleet does not validate a server’s certificate when connecting through SSH. This can allow for a main-in-the-middle-attack against Fleet. The fix provides a new
If
If
This happens regardless of whether a A limitation with the default
|
24 Apr 2025 |
||
A vulnerability was found where users could create a project and then gain access to arbitrary projects. As a fix, a new field has been added to projects called the The field is populated automatically during project creation and is formatted as |
24 Apr 2025 |
||
A vulnerability was found where users with permission to create a service in the Kubernetes cluster where Rancher is deployed can take over the Rancher UI, display their own UI, and gather sensitive information. This is only possible when the setting |
24 Apr 2025 |
||
A vulnerability has been identified within Rancher where a Restricted Administrator can change the password of Administrators and take over their accounts. A Restricted Administrator should not be allowed to change the password of more privileged users unless it contains the Manage Users permissions. A new validation has been added to block a user from editing or deleting another user with more permissions than themselves. Rancher deployments where the Restricted Administrator role is not being used are not affected by this CVE. |
31 Mar 2025 |
||
A vulnerability in Rancher has been discovered, leading to a local user impersonation through SAML Authentication on first login. The issue occurs when a SAML authentication provider (AP) is configured (e.g. Keycloak). A newly created AP user can impersonate any user on Rancher by manipulating cookie values during their initial login to Rancher. This vulnerability could also be exploited if a Rancher user (present on the AP) is removed, either manually or automatically via the User Retention feature with delete-inactive-user-after |
27 Feb 2025 |
||
An unauthenticated stack overflow crash, leading to a denial of service (DoS), was identified in Rancher’s This vulnerability affects those using external authentication providers as well as Rancher’s local authentication. |
27 Feb 2025 |
||
A vulnerability has been identified within Rancher where it is possible for an unauthenticated user to list all CLI authentication tokens and delete them before the CLI is able to get the token value. This effectively prevents users from logging in via the CLI when using rancher token as the execution command (instead of the token directly being in the kubeconfig). Note that this token is not the kubeconfig token and if an attacker is able to intercept it they can’t use it to impersonate a real user since it is encrypted. |
27 Feb 2025 |
||
A high severity vulnerability was identified within the Rancher UI that allows a malicious actor to perform a Stored XSS attack through the cluster description field. |
15 Jan 2025 |