Rancher

This hub aggregates every CVE we track for Rancher, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Rancher.

• CVE-2026-75035Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass7.7Sep 3, 2026
• CVE-2026-75034Rancher: SAML Assertion Replay7.4Sep 3, 2026
• CVE-2026-75033Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing7.7Sep 3, 2026
• CVE-2026-71404Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole8.7Sep 3, 2026
• CVE-2026-71403Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind6.1Sep 3, 2026
• CVE-2026-44945Cross-Cluster Impersonation Confused-Deputy Privilege Escalation9.1Aug 5, 2026
• CVE-2026-55997Long-lived Rancher registration token exposed in plaintext8.8Aug 5, 2026
• CVE-2026-55998Cluster Existence Oracle via Unauthenticated Import Endpoint5.3Aug 5, 2026
• CVE-2026-59675Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service7.5Aug 5, 2026
• CVE-2026-55996Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent4.3Aug 5, 2026
• CVE-2026-44938Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent8.8Jul 7, 2026
• CVE-2026-44937SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components8.2Jul 6, 2026
• CVE-2026-44936Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml5.0Jul 6, 2026
• CVE-2026-44934Exposed tokens in SUSE Rancher AI Agent logsJul 6, 2026
• CVE-2026-44935Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer9.9Jul 2, 2026