https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:29:54.184194+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-00908 bdu:2023-00908 2026-10-03T14:29:54.288323+00:00 bdu:2023-00908 https://cve.radiocsirt.org/vuln/euvd-2026-224909 EUVD-2026-224909 2026-10-03T14:29:54.288364+00:00 EUVD-2026-224909 https://cve.radiocsirt.org/vuln/fkie_cve-2022-43758 fkie_cve-2022-43758 2026-10-03T14:29:54.288380+00:00

A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM (only admin users by default) This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

 https://cve.radiocsirt.org/vuln/ghsa-34p5-jp77-fcrc GHSA-34p5-jp77-fcrc — Command injection in Rancher Git package 2026-10-03T14:29:54.288415+00:00

Affected: Go: github.com/rancher/rancher

### Impact

An issue was discovered in Rancher from versions 2.5.0 up to and including 2.5.16, 2.6.0 up to and including 2.6.9 and 2.7.0, where a command injection vulnerability is present in the Rancher Git package. This package uses the underlying Git binary available in the Rancher container image to execute Git operations.

Specially crafted commands, when not properly disambiguated, can cause confusion when executed through Git, resulting in command injection in the underlying Rancher host.

This issue can potentially be exploited in Rancher in two ways:

1. Adding an untrusted Helm catalog, in the Catalogs menu, that contains maliciously designed repo URL configuration in Helm charts. 2. Modifying the URL configuration used to download KDM (Kontainer Driver Metadata) releases.

By default, only the Rancher admin has permission to manage both configurations for the local cluster (the cluster where Rancher is provisioned).

Note: More information about this category of issue in version control system (VCS) tools are available in Snyk's [blog post](https://snyk.io/blog/argument-injection-when-using-git-and-mercurial/).

### Workarounds

Except for only adding trusted catalogs and the KDM URL to Rancher, there is no other workaround besides updating Rancher to a patched version.

### Patches

Patched versions include releases 2.5.17, 2.6.10, 2.7.1 and later versions.

It is also important to update to a patched version in case Rancher or its standalone Git package implemen…

 https://cve.radiocsirt.org/vuln/gsd-2022-43758 gsd-2022-43758 2026-10-03T14:29:54.288468+00:00 gsd-2022-43758 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0197 WID-SEC-W-2023-0197 — Rancher: Mehrere Schwachstellen 2026-10-03T14:29:54.288481+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, seine Rechte zu erweitern und Code auszuführen.