https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:11:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-224922 EUVD-2026-224922 https://cve.radiocsirt.org/vuln/euvd-2026-224922 https://cve.radiocsirt.org/vuln/fkie_cve-2022-43755 <p>A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issue affects: SUSE Rancher Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.</p> <p>A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issue affects: SUSE Rancher Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-43755 https://cve.radiocsirt.org/vuln/ghsa-8c69-r38j-rpfj <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact</p> <p>An issue was discovered in Rancher versions up to and including 2.6.9 and 2.7.0, where the `cattle-token` secret, used by the `cattle-cluster-agent`, is predictable. Even after the token is regenerated, it will have the same value. This issue is not present in Rancher 2.5 releases.</p> <p>The `cattle-token` is used by Rancher&#39;s `cattle-cluster-agent` to connect to the Kubernetes API of Rancher provisioned downstream clusters. The problem occurs because the `cattle-token` secret does not use any random value in its composition, which causes it to always be regenerated with the same value. This can pose a serious problem if the token is compromised and needs to be recreated for security purposes.</p> <p>The usage of the `cattle-token` by an unauthorized user allows to escalate privileges to the cluster owner of the affected downstream cluster. It does not allow access to Rancher&#39;s own local cluster (the cluster where Rancher is provisioned).</p> <p>### Workarounds</p> <p>In case it is not possible to promptly update to a patched version, a workaround is to use the [rotate script](https://github.com/rancherlabs/support-tools/tree/master/rotate-tokens) provided in the public security advisory [CVE-2021-36782 / GHSA-g7j7-h4q8-8w2f](https://github.com/rancher/rancher/security/advisories/GHSA-g7j7-h4q8-8w2f), which facilitates the rotation and creation of a new unique downstream cluster token.</p> <p>### Patches</p> <p>Patched versions include releases 2.6.10, 2.7.1 and later versions.</p> <p>After upgrading to…</p> <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact</p> <p>An issue was discovered in Rancher versions up to and including 2.6.9 and 2.7.0, where the `cattle-token` secret, used by the `cattle-cluster-agent`, is predictable. Even after the token is regenerated, it will have the same value. This issue is not present in Rancher 2.5 releases.</p> <p>The `cattle-token` is used by Rancher&#39;s `cattle-cluster-agent` to connect to the Kubernetes API of Rancher provisioned downstream clusters. The problem occurs because the `cattle-token` secret does not use any random value in its composition, which causes it to always be regenerated with the same value. This can pose a serious problem if the token is compromised and needs to be recreated for security purposes.</p> <p>The usage of the `cattle-token` by an unauthorized user allows to escalate privileges to the cluster owner of the affected downstream cluster. It does not allow access to Rancher&#39;s own local cluster (the cluster where Rancher is provisioned).</p> <p>### Workarounds</p> <p>In case it is not possible to promptly update to a patched version, a workaround is to use the [rotate script](https://github.com/rancherlabs/support-tools/tree/master/rotate-tokens) provided in the public security advisory [CVE-2021-36782 / GHSA-g7j7-h4q8-8w2f](https://github.com/rancher/rancher/security/advisories/GHSA-g7j7-h4q8-8w2f), which facilitates the rotation and creation of a new unique downstream cluster token.</p> <p>### Patches</p> <p>Patched versions include releases 2.6.10, 2.7.1 and later versions.</p> <p>After upgrading to…</p> https://cve.radiocsirt.org/vuln/ghsa-8c69-r38j-rpfj https://cve.radiocsirt.org/vuln/gsd-2022-43755 gsd-2022-43755 https://cve.radiocsirt.org/vuln/gsd-2022-43755 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0197 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, seine Rechte zu erweitern und Code auszuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, seine Rechte zu erweitern und Code auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0197