Developer Tools

In Rancher versions 2.7.0 to before 2.7.14 and 2.8.0 to before 2.8.5 a medium severity vulnerability CVE-2023-32197 was detected. This vulnerability allows attackers to gain more permissions than they should in certain cases where RoleTemplate objects are set with external=true. To address this issue, users should upgrade Rancher to version 2.7.14 or 2.8.5. For more details, visit https://avd.aquasec.com/nvd/2023/cve-2023-32197.

In Rancher versions 2.7.0 to before 2.7.16, 2.8.0 to before 2.8.9, and 2.9.0 to before 2.9.3 a critical severity vulnerability CVE-2024-22036 was detected. This vulnerability lets attackers break out of the Rancher container and get root access. In test setups, they could even escape the container and run code on the host machine. To address this issue, users should upgrade Rancher to version 2.7.16, 2.8.9, or 2.9.3. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-22036.

In SUSE Rancher versions from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7 and from 2.10.0 before 2.10.3 a medium severity vulnerability CVE-2025-23387 was detected. This vulnerability allows unauthenticated attackers to list and delete CLI authentication tokens before they are retrieved, exposing sensitive information. To address this issue, users should upgrade SUSE Rancher to versions 2.8.13, 2.9.7 or 2.10.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-23387.

In SUSE Rancher from 2.8.0 before 2.8.10 and from 2.9.0 before 2.9.4 a medium severity vulnerability CVE-2024-52282 was detected. This vulnerability allows any user with GET access to the Rancher Manager Apps Catalog to read sensitive information contained in the Apps’ values, which also gets exposed in audit logs when the audit level is set to 2 or higher. To address this issue, users should upgrade SUSE Rancher to versions 2.8.10 or 2.9.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-52282.

In SUSE Rancher versions before commits 2175e09, 6e30359 and c744f0b a high severity vulnerability CVE-2024-52280 was detected. This vulnerability allows users with generic permissions on a resource type to watch resources they are not explicitly authorized to access. To address this issue, users should upgrade SUSE Rancher to commits 2175e09 (main), 6e30359 (release/v2.9), c744f0b (release/v2.8) or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-52280.

In Rancher versions from 2.8.0 before 2.8.14, 2.9.0 before 2.9.8, 2.10.0 before 2.10.4 and prior to 2.11.0 a critical severity vulnerability CVE-2025-23391 was detected. This vulnerability allows a Restricted Administrator to change the passwords of full Administrators, potentially leading to account takeover. To address this issue, users should upgrade Rancher to versions 2.8.14, 2.9.8, 2.11.0 or 2.10.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-23391.

In Rancher versions from 2.8.0 before 2.8.13, 2.9.0 before 2.9.7 and 2.10.0 before 2.10.3 a high severity vulnerability CVE-2025-23389 was detected. This vulnerability allows a local user to impersonate other identities through SAML Authentication during first login. To address this issue, users should upgrade Rancher to versions 2.8.13, 2.9.7 or 2.10.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-23389.

In Rancher versions from 2.8.0 before 2.8.13, 2.9.0 before 2.9.7 and 2.10.0 before 2.10.3 a high severity vulnerability CVE-2025-23388 was detected. This vulnerability allows attackers to trigger a stack-based buffer overflow, potentially causing a denial of service. To address this issue, users should upgrade Rancher to versions 2.8.13, 2.9.7 or 2.10.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-23388.

In GitLab CE/EE versions up to 17.8.7, 17.9 before 17.9.6 and 17.10 before 17.10.4 a medium severity vulnerability CVE-2025-1677 was detected. This vulnerability allows attackers to trigger a Denial of Service (DoS) by injecting oversized payloads into CI pipeline exports. To address this issue, users should upgrade GitLab CE/EE to versions 17.8.7, 17.9.6 or 17.10.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1677.