https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:53:32 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-254001 EUVD-2026-254001 https://cve.radiocsirt.org/vuln/euvd-2026-254001 https://cve.radiocsirt.org/vuln/fkie_cve-2024-58260 <p>A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts.</p> <p>A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-58260 https://cve.radiocsirt.org/vuln/ghsa-q82v-h4rq-5c86 <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact</p> <p>A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts. Specifically:</p> <p>- Username takeover: A user with permission to update another user’s resource can set its `.username` to &#34;admin&#34;, preventing both the legitimate admin and the affected user from logging in, as Rancher enforces uniqueness at login time. - Account lockout: A user with update permissions on the admin account can change the admin’s username, effectively blocking administrative access to the Rancher UI.</p> <p>This issue enables a malicious or compromised account with elevated update privileges on User resources to disrupt platform administration and user authentication.</p> <p>**Note:** The users with these permissions to modify accounts and resources are considered as privileged users. For more information, please consult Rancher Manger’s documentation about [global permissions](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions).</p> <p>Please consult the associated [MITRE ATT&amp;CK - Technique - Account Access Removal](https://attack.mitre.org/techniques/T1531/) for further information about this category of attack.</p> <p>### Patches</p> <p>This vulnerability is addressed by adding a new check in the webhook whi…</p> <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact</p> <p>A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts. Specifically:</p> <p>- Username takeover: A user with permission to update another user’s resource can set its `.username` to &#34;admin&#34;, preventing both the legitimate admin and the affected user from logging in, as Rancher enforces uniqueness at login time. - Account lockout: A user with update permissions on the admin account can change the admin’s username, effectively blocking administrative access to the Rancher UI.</p> <p>This issue enables a malicious or compromised account with elevated update privileges on User resources to disrupt platform administration and user authentication.</p> <p>**Note:** The users with these permissions to modify accounts and resources are considered as privileged users. For more information, please consult Rancher Manger’s documentation about [global permissions](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions).</p> <p>Please consult the associated [MITRE ATT&amp;CK - Technique - Account Access Removal](https://attack.mitre.org/techniques/T1531/) for further information about this category of attack.</p> <p>### Patches</p> <p>This vulnerability is addressed by adding a new check in the webhook whi…</p> https://cve.radiocsirt.org/vuln/ghsa-q82v-h4rq-5c86 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15666-1 <p>govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15666-1 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2141 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial of Service herbeizuführen und Informationen auszuspähen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial of Service herbeizuführen und Informationen auszuspähen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2141