# github.com/rancher/rancher (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-rancher-rancher Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-rancher-rancher.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 61 vulnerabilities in github.com/rancher/rancher (Go): 0 in the last 7 days and 1 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2024-22031, was published on 15 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 1 - All time: 61 (1 critical, 0 exploited in the wild) ## About github.com/rancher/rancher (Go) Kubernetes cluster management platform that provisions and manages container orchestration across multiple clusters. ## Latest github.com/rancher/rancher (Go) vulnerabilities - [CVE-2024-22031: Rancher privilege escalation via project name collision](https://junglewise.ai/threats/cve-2024-22031-rancher-users-who-can-create-projects-can-gain-access-to) (high, CVSS 8.5, published 15 Oct 2026) - [CVE-2026-41053: SUSE Rancher privilege escalation in GitHub App authentication provider](https://junglewise.ai/threats/cve-2026-41053-suse-rancher-privilege-escalation-in-github-app-authentication) (high, CVSS 8.8, published 30 Jun 2026) - [CVE-2026-41052: SUSE Rancher privilege escalation in Project Owner role](https://junglewise.ai/threats/cve-2026-41052-suse-rancher-privilege-escalation-in-project-owner-role) (high, CVSS 8.4, published 29 Jun 2026) - [CVE-2026-44939: SUSE Rancher command injection in cluster import endpoint](https://junglewise.ai/threats/cve-2026-44939-suse-rancher-command-injection-in-cluster-import-endpoint) (critical, CVSS 9.6, published 19 Jun 2026) - [CVE-2026-25705: SUSE Rancher path traversal in UI Extensions](https://junglewise.ai/threats/cve-2026-25705-suse-rancher-path-traversal-in-ui-extensions) (high, CVSS 8.4, published 13 May 2026) - [GO-2026-4590 - Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user in…](https://junglewise.ai/threats/go-2026-4590-rancher-s-restricted-podsecuritypolicy-does-not-prevent-dea62d9a) (info, published 10 Mar 2026) - [CVE-2021-25320: GO-2026-4589 - Rancher cloud credentials can be used through proxy API by users without access in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2021-25320-rancher-cloud-credentials-can-be-used-through-proxy-api-by-users) (low, CVSS 3.1, published 10 Mar 2026) - [Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user](https://junglewise.ai/threats/rancher-s-restricted-podsecuritypolicy-does-not-prevent-containers-from-eb706e8d) (medium, CVSS 4, published 3 Mar 2026) - [CVE-2022-21951: Rancher's weave CNI password is not configured when a cluster is created from an RKE template](https://junglewise.ai/threats/cve-2022-21951-rancher-s-weave-cni-password-is-not-configured-when-a-cluster-is) (low, CVSS 3.1, published 3 Mar 2026) - [CVE-2022-31247: Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)](https://junglewise.ai/threats/cve-2022-31247-rancher-has-downstream-cluster-privilege-escalation-through) (low, CVSS 3.1, published 3 Mar 2026) - [CVE-2021-36783: Rancher doesn't properly sanitize credentials in cluster template answers](https://junglewise.ai/threats/cve-2021-36783-rancher-doesn-t-properly-sanitize-credentials-in-cluster-template) (low, CVSS 3.1, published 3 Mar 2026) - [CVE-2023-22648: Rancher's Azure AD permission changes are not reflected on active sessions](https://junglewise.ai/threats/cve-2023-22648-rancher-s-azure-ad-permission-changes-are-not-reflected-on-active) (low, CVSS 3.1, published 3 Mar 2026) - [CVE-2025-67601: GO-2026-4393 - Rancher CLI skips TLS verification on Rancher CLI login command in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2025-67601-rancher-cli-skips-tls-verification-on-rancher-cli-login-command) (low, CVSS 3.1, published 2 Feb 2026) - [CVE-2023-32199: GO-2025-4073 - Rancher user retains access to clusters despite Global Role removal in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2023-32199-rancher-user-retains-access-to-clusters-despite-global-role) (low, CVSS 3.1, published 30 Oct 2025) - [CVE-2024-58269: GO-2025-4074 - Rancher exposes sensitive information through audit logs in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2024-58269-rancher-exposes-sensitive-information-through-audit-logs) (medium, CVSS 4.3, published 29 Oct 2025) - [CVE-2024-58260: GO-2025-3983 - Rancher update on users can deny the service to the admin in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2024-58260-rancher-update-on-users-can-deny-the-service-to-the-admin) (low, CVSS 3.1, published 23 Oct 2025) - [CVE-2025-54468: Rancher sends sensitive information to external services through the `/meta/proxy` endpoint](https://junglewise.ai/threats/cve-2025-54468-rancher-sends-sensitive-information-to-external-services-through) (low, CVSS 3.1, published 23 Oct 2025) - [CVE-2024-58267: GO-2025-3984 - Rancher CLI SAML authentication is vulnerable to phishing attacks in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2024-58267-rancher-cli-saml-authentication-is-vulnerable-to-phishing-attacks) (low, CVSS 3.1, published 23 Oct 2025) - [CVE-2024-58259: GO-2025-3923 - Rancher affected by unauthenticated Denial of Service in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2024-58259-rancher-affected-by-unauthenticated-denial-of-service) (low, CVSS 3.1, published 8 Sep 2025) - [CVE-2025-23391: GO-2025-3586 - Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2025-23391-rancher-restricted-administrator-can-change-administrator-s) (low, CVSS 3.1, published 2 Apr 2025) - [CVE-2025-23389: Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login](https://junglewise.ai/threats/cve-2025-23389-rancher-does-not-properly-validate-account-bindings-in-saml) (low, CVSS 3.1, published 3 Mar 2025) - [CVE-2025-23388: GO-2025-3491 - Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API in…](https://junglewise.ai/threats/cve-2025-23388-rancher-allows-an-unauthenticated-stack-overflow-in-v3-public) (low, CVSS 3.1, published 3 Mar 2025) - [CVE-2025-23387: GO-2025-3489 - Rancher's SAML-based login via CLI can be denied by unauthenticated users in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2025-23387-rancher-s-saml-based-login-via-cli-can-be-denied-by) (low, CVSS 3.1, published 3 Mar 2025) - [CVE-2024-52281: GO-2025-3391 - Rancher UI has Stored Cross-site Scripting vulnerability in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2024-52281-rancher-ui-has-stored-cross-site-scripting-vulnerability) (low, CVSS 3.1, published 15 Jan 2025) - [CVE-2024-52282: GO-2024-3280 - Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2024-52282-rancher-helm-applications-may-have-sensitive-values-leaked) (low, CVSS 3.1, published 21 Nov 2024) ## Most severe github.com/rancher/rancher (Go) vulnerabilities - [CVE-2026-44939: SUSE Rancher command injection in cluster import endpoint](https://junglewise.ai/threats/cve-2026-44939-suse-rancher-command-injection-in-cluster-import-endpoint) (critical, CVSS 9.6, published 19 Jun 2026) - [CVE-2026-41053: SUSE Rancher privilege escalation in GitHub App authentication provider](https://junglewise.ai/threats/cve-2026-41053-suse-rancher-privilege-escalation-in-github-app-authentication) (high, CVSS 8.8, published 30 Jun 2026) - [CVE-2024-22031: Rancher privilege escalation via project name collision](https://junglewise.ai/threats/cve-2024-22031-rancher-users-who-can-create-projects-can-gain-access-to) (high, CVSS 8.5, published 15 Oct 2026) - [CVE-2026-25705: SUSE Rancher path traversal in UI Extensions](https://junglewise.ai/threats/cve-2026-25705-suse-rancher-path-traversal-in-ui-extensions) (high, CVSS 8.4, published 13 May 2026) - [CVE-2026-41052: SUSE Rancher privilege escalation in Project Owner role](https://junglewise.ai/threats/cve-2026-41052-suse-rancher-privilege-escalation-in-project-owner-role) (high, CVSS 8.4, published 29 Jun 2026) - [CVE-2024-58269: GO-2025-4074 - Rancher exposes sensitive information through audit logs in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2024-58269-rancher-exposes-sensitive-information-through-audit-logs) (medium, CVSS 4.3, published 29 Oct 2025) - [Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user](https://junglewise.ai/threats/rancher-s-restricted-podsecuritypolicy-does-not-prevent-containers-from-eb706e8d) (medium, CVSS 4, published 3 Mar 2026) - [CVE-2021-36782: Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials](https://junglewise.ai/threats/cve-2021-36782-rancher-api-and-cluster-management-cattle-io-object-vulnerable-to) (low, CVSS 3.1, published 23 Sep 2022) - [CVE-2023-22649: GO-2024-2537 - Rancher 'Audit Log' leaks sensitive information in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2023-22649-rancher-audit-log-leaks-sensitive-information) (low, CVSS 3.1, published 28 Jun 2024) - [CVE-2018-20321: GO-2022-0644 - Access Control Bypass in github.com/rancher/rancher](https://junglewise.ai/threats/cve-2018-20321-access-control-bypass) (low, CVSS 3.1, published 21 Aug 2024) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/rancher/rancher (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-rancher-rancher, 13 November 2026.