Rancher vulnerabilities
We track 4 vulnerabilities in Rancher products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 5, 2026.
Latest Rancher vulnerabilities
- 8.8 High severity
rancher: Cleartext Storage of Sensitive Information
Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored
- 8.7 High severity
local-path-provisioner: Improper Privilege Management
Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod
- 7.2 High severity
rancher: Improper Privilege Management
A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will receive * permissions for core namespaces. This can lead to someone being capable of accessing, creating,
- 8.3 High severity
norman: Improper Neutralization of Script-Related HTML Tags in a Web Page
A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.