Rancher

This hub aggregates every CVE we track for Rancher, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Rancher.

• CVE-2026-44945Cross-Cluster Impersonation Confused-Deputy Privilege Escalation9.1Aug 5, 2026
• CVE-2026-55997Long-lived Rancher registration token exposed in plaintext8.8Aug 5, 2026
• CVE-2026-55998Cluster Existence Oracle via Unauthenticated Import Endpoint5.3Aug 5, 2026
• CVE-2026-59675Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service7.5Aug 5, 2026
• CVE-2026-55996Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent4.3Aug 5, 2026
• CVE-2026-44938Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent8.8Jul 7, 2026
• CVE-2026-44937SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components8.2Jul 6, 2026
• CVE-2026-44936Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml5.0Jul 6, 2026
• CVE-2026-44935Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer9.9Jul 2, 2026
• CVE-2026-44946SAML Authentication Replay in Rancher7.4Jun 30, 2026
• CVE-2026-41053Over-inclusive team membership expansion in GitHub App authentication provider for Rancher8.8Jun 30, 2026
• CVE-2026-41052Rancher Privilege Escalation from Project Owner to Host8.8Jun 29, 2026
• CVE-2026-41050Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering9.9May 13, 2026
• CVE-2026-25705Rancher Extensions have arbitrary file access via path traversal8.4May 13, 2026
• CVE-2025-62879Rancher Backup Operator pod's logs leak S3 tokens6.8Mar 4, 2026