https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T18:57:14.919674+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-195976 EUVD-2026-195976 2026-10-06T18:57:14.922900+00:00 EUVD-2026-195976 https://cve.radiocsirt.org/vuln/fkie_cve-2023-22650 fkie_cve-2023-22650 2026-10-06T18:57:14.922929+00:00

A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.

 https://cve.radiocsirt.org/vuln/ghsa-9ghh-mmcq-8phc GHSA-9ghh-mmcq-8phc — Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider 2026-10-06T18:57:14.922961+00:00

Affected: Go: github.com/rancher/rancher

### Impact

A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.

An AP must be enabled to be affected by this, as the built-in User Management feature is not affected by this vulnerability. This issue may lead to an adversary gaining unauthorized access, as the user’s access privileges may still be active within Rancher even though they are no longer valid on the configured AP (please consult the [MITRE ATT&CK - Technique - Valid Accounts](https://attack.mitre.org/techniques/T1078/) for further information about the associated technique of attack).

It’s important to note that all configurable APs are impacted, see [Rancher Docs - Configuring Authentication - External vs. Local Authentication](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config#external-vs-local-authentication) to get the full authentication providers list.

To address this issue, the fix introduces a new user retention process that can be configured to run periodically and disable and/or delete inactive users. If enabled a user becomes subject to retention if they don't login for a configurable period of time. It's possible to set overrides for users t…

 https://cve.radiocsirt.org/vuln/gsd-2023-22650 gsd-2023-22650 2026-10-06T18:57:14.923019+00:00 gsd-2023-22650 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1397 WID-SEC-W-2024-1397 — Rancher: Mehrere Schwachstellen 2026-10-06T18:57:14.923033+00:00

Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Dateien zu manipulieren, seine Privilegien zu erweitern oder vertrauliche Informationen offenzulegen.