Technology · Go
github.com/rancher/rancher (Go) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 61 vulnerabilities in github.com/rancher/rancher (Go): 0 in the last 7 days and 1 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2024-22031, was published on 15 October 2026. 1 vulnerability in the last four weeks, up from none in the four before.
- Last 7 days
- 0
- Last 90 days
- 1
- Critical, all time
- 1
- Exploited in the wild
- 0
About github.com/rancher/rancher (Go)
Kubernetes cluster management platform that provisions and manages container orchestration across multiple clusters.
Latest github.com/rancher/rancher (Go) vulnerabilities
- CVE-2024-22031: Rancher privilege escalation via project name collisionhighCVSS 8.5EPSS 0.4%
- CVE-2026-41053: SUSE Rancher privilege escalation in GitHub App authentication providerhighCVSS 8.8EPSS 0.5%
- CVE-2026-41052: SUSE Rancher privilege escalation in Project Owner rolehighCVSS 8.4EPSS 0.4%
- CVE-2026-44939: SUSE Rancher command injection in cluster import endpointcriticalCVSS 9.6EPSS 1.3%
- CVE-2026-25705: SUSE Rancher path traversal in UI ExtensionshighCVSS 8.4EPSS 0.5%
- GO-2026-4590 - Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user in…info
- CVE-2021-25320: GO-2026-4589 - Rancher cloud credentials can be used through proxy API by users without access in github.com/rancher/rancherlowCVSS 3.1EPSS 0.9%
- Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged usermediumCVSS 4
- CVE-2022-21951: Rancher's weave CNI password is not configured when a cluster is created from an RKE templatelowCVSS 3.1EPSS 0.4%
- CVE-2022-31247: Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)lowCVSS 3.1EPSS 1.0%
- CVE-2021-36783: Rancher doesn't properly sanitize credentials in cluster template answerslowCVSS 3.1EPSS 0.8%
- CVE-2023-22648: Rancher's Azure AD permission changes are not reflected on active sessionslowCVSS 3.1EPSS 0.4%
- CVE-2025-67601: GO-2026-4393 - Rancher CLI skips TLS verification on Rancher CLI login command in github.com/rancher/rancherlowCVSS 3.1EPSS 0.2%
- CVE-2023-32199: GO-2025-4073 - Rancher user retains access to clusters despite Global Role removal in github.com/rancher/rancherlowCVSS 3.1EPSS 0.2%
- CVE-2024-58269: GO-2025-4074 - Rancher exposes sensitive information through audit logs in github.com/rancher/ranchermediumCVSS 4.3EPSS 0.3%
- CVE-2024-58260: GO-2025-3983 - Rancher update on users can deny the service to the admin in github.com/rancher/rancherlowCVSS 3.1EPSS 0.5%
- CVE-2025-54468: Rancher sends sensitive information to external services through the `/meta/proxy` endpointlowCVSS 3.1EPSS 0.4%
- CVE-2024-58267: GO-2025-3984 - Rancher CLI SAML authentication is vulnerable to phishing attacks in github.com/rancher/rancherlowCVSS 3.1EPSS 0.2%
- CVE-2024-58259: GO-2025-3923 - Rancher affected by unauthenticated Denial of Service in github.com/rancher/rancherlowCVSS 3.1EPSS 0.5%
- CVE-2025-23391: GO-2025-3586 - Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancherlowCVSS 3.1EPSS 0.5%
- CVE-2025-23389: Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First LoginlowCVSS 3.1EPSS 0.5%
- CVE-2025-23388: GO-2025-3491 - Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API in…lowCVSS 3.1EPSS 0.6%
- CVE-2025-23387: GO-2025-3489 - Rancher's SAML-based login via CLI can be denied by unauthenticated users in github.com/rancher/rancherlowCVSS 3.1EPSS 0.6%
- CVE-2024-52281: GO-2025-3391 - Rancher UI has Stored Cross-site Scripting vulnerability in github.com/rancher/rancherlowCVSS 3.1EPSS 0.5%
- CVE-2024-52282: GO-2024-3280 - Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancherlowCVSS 3.1EPSS 0.4%
Most severe github.com/rancher/rancher (Go) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-44939: SUSE Rancher command injection in cluster import endpointcriticalCVSS 9.6EPSS 1.3%
- CVE-2026-41053: SUSE Rancher privilege escalation in GitHub App authentication providerhighCVSS 8.8EPSS 0.5%
- CVE-2024-22031: Rancher privilege escalation via project name collisionhighCVSS 8.5EPSS 0.4%
- CVE-2026-25705: SUSE Rancher path traversal in UI ExtensionshighCVSS 8.4EPSS 0.5%
- CVE-2026-41052: SUSE Rancher privilege escalation in Project Owner rolehighCVSS 8.4EPSS 0.4%
- CVE-2024-58269: GO-2025-4074 - Rancher exposes sensitive information through audit logs in github.com/rancher/ranchermediumCVSS 4.3EPSS 0.3%
- Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged usermediumCVSS 4
- CVE-2021-36782: Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentialslowCVSS 3.1EPSS 4.2%
- CVE-2023-22649: GO-2024-2537 - Rancher 'Audit Log' leaks sensitive information in github.com/rancher/rancherlowCVSS 3.1EPSS 2.0%
- CVE-2018-20321: GO-2022-0644 - Access Control Bypass in github.com/rancher/rancherlowCVSS 3.1EPSS 1.8%
Vulnerabilities per week
1 vulnerability in the last four weeks, up from none in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 1 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many github.com/rancher/rancher (Go) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/github-com-rancher-rancher)<a href="https://junglewise.ai/threats/technologies/github-com-rancher-rancher"><img src="https://junglewise.ai/threats/technologies/github-com-rancher-rancher/badge.svg" alt="github.com/rancher/rancher (Go) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/github-com-rancher-rancher.json, and this page as text at https://junglewise.ai/threats/technologies/github-com-rancher-rancher.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "github.com/rancher/rancher (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-rancher-rancher, 13 November 2026.