Loading...
Skip to main content
GeekWala

CVE-2021-25320 — Vulnerability in github.com/rancher/rancher — CVE...

CRITICAL

Rancher cloud credentials can be used through proxy API by users without access

Published March 3, 2026Updated September 10, 2026Source: osv

Summary

A vulnerability was discovered in Rancher 2.2.0 through the aforementioned patched versions, where cloud credentials weren't being properly validated through the Rancher API. Specifically through a proxy designed to communicate with cloud providers. Any Rancher user that was logged-in and aware of a cloud-credential ID that was valid for a given cloud provider, could call that cloud provider's API through the proxy API, and the cloud-credential would be attached. The exploit is limited to valid Rancher users. There is not a direct mitigation outside of upgrading to the patched Rancher versions.

Advisory Timeline

  • First published March 3, 2026 (223 days ago).
  • Last revised September 10, 2026 — 191 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update github.com/rancher/rancher to 2.4.16 or later
go get github.com/rancher/rancher@v2.4.16
Go
Update github.com/rancher/rancher to 2.5.9 or later
go get github.com/rancher/rancher@v2.5.9

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/rancher/rancher
go
All versions2.4.16
github.com/rancher/rancher
go
All versions2.5.9

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2021-25320?
Rancher cloud credentials can be used through proxy API by users without access This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2021-25320?
CVE-2021-25320 affects github.com/rancher/rancher. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2021-25320 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-gqf8-rvrh-g7w6
GO-2026-4589

Related CVEs

  • CVE-2022-31247
    CRITICAL

    Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

  • CVE-2023-32196
    CRITICAL

    Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists

  • CVE-2025-23391
    CRITICAL

    Rancher: Restricted Administrator can change Administrator's passwords

  • CVE-2021-36783
    CRITICAL

    Rancher doesn't properly sanitize credentials in cluster template answers

  • CVE-2021-36782
    CRITICAL

    Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials

  • CVE-2024-22036
    CRITICAL

    Rancher Remote Code Execution via Cluster/Node Drivers

  • CVE-2024-22031
    HIGH

    Rancher users who can create Projects can gain access to arbitrary projects

  • CVE-2023-22650
    HIGH

    Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies