SUSE Rancher.

Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy

• SUSE Rancher
• Information disclosure

Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRules

• SUSE Rancher
• Authentication bypass

Rancher meta proxy allowlist bypass leading to server-side request forgery

• SUSE Rancher
• Server-side request forgery (SSRF)

Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller

• SUSE Rancher
• Privilege escalation

Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster

• SUSE Rancher
• Authentication bypass

Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace

• SUSE Rancher
• Authentication bypass

Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher

• SUSE Rancher
• Cross-site scripting (XSS)

Session Not Revoked Server-Side on Logout in Rancher

• SUSE Rancher
• Authentication bypass

Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters

• SUSE Rancher
• Privilege escalation

Fleet applies namespace labels and annotations without the bundle's service account privileges

• SUSE Rancher
• Privilege escalation

Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver

• SUSE Rancher
• Authentication bypass

Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet

• SUSE Rancher
• Authentication bypass
• Broken access control

Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory

• SUSE Rancher
• Path traversal

Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass

• SUSE Rancher
• Broken access control

Rancher: SAML Assertion Replay

• SUSE Rancher
• Authentication bypass

Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing

• SUSE Rancher
• Broken access control

Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole

• SUSE Rancher
• Broken access control

Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind

• SUSE Rancher
• Broken access control

Cross-Cluster Impersonation Confused-Deputy Privilege Escalation

• SUSE Rancher
• Information disclosure
• CWE-441

Cluster Existence Oracle via Unauthenticated Import Endpoint

• SUSE Rancher
• CWE-204

Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service

• SUSE Rancher
• Denial of service

Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent

• SUSE Rancher
• Denial of service

Exposed tokens in SUSE Rancher AI Agent logs

• SUSE Rancher
• CWE-215

Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler

• SUSE Rancher
• Path traversal

Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook

• SUSE Rancher
• Authentication bypass

Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher

• SUSE Rancher
• CWE-281

SAML Authentication Replay in Rancher

• SUSE Rancher
• Authentication bypass

rancher desktop: Dashboard API is network accessible

• SUSE Rancher
• Information disclosure

K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token

• SUSE Rancher
• Weak cryptography or TLS