https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:23:19 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329725 EUVD-2026-329725 https://cve.radiocsirt.org/vuln/euvd-2026-329725 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44939 <p>A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.</p> <p>A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44939 https://cve.radiocsirt.org/vuln/ghsa-mhc6-2gfq-xx62 <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact A critical command injection vulnerability has been identified in the Rancher Manager cluster import endpoint `/v3/import/{token}_{clusterId}.yaml` through unsanitized YAML parameters. This endpoint accepts an `authImage` query parameter that is rendered without sanitization into a generated Kubernetes manifest template. By including URL-encoded newlines in the parameter value, an attacker can break out of the `image:` field to inject arbitrary YAML keys and malicious configurations, such as commands to execute malicious containers.</p> <p>Exploitation of this vulnerability requires the following conditions to be met: - Attackers must obtain a valid cluster registration token (these tokens may be exposed, for example, through documentation, screenshots, or insecure communication channels). - The victim’s cluster operator must execute `kubectl apply` against a maliciously crafted URL.</p> <p>When a victim applies this compromised manifest using `kubectl apply`, a DaemonSet is deployed with the injected configuration. This DaemonSet: - Runs on all control-plane nodes with `hostNetwork: true` enabled. - Uses the `cattle` service account, which possesses `cluster-admin` privileges. - Mounts `/etc/kubernetes` directly from the host. - Executes attacker-controlled commands via the injected `command:` field.</p> <p>An attacker who successfully exploits this vulnerability could:</p> <p>- Achieve full control over downstream Kubernetes clusters. - Execute arbitrary code on control-plane nodes w…</p> <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact A critical command injection vulnerability has been identified in the Rancher Manager cluster import endpoint `/v3/import/{token}_{clusterId}.yaml` through unsanitized YAML parameters. This endpoint accepts an `authImage` query parameter that is rendered without sanitization into a generated Kubernetes manifest template. By including URL-encoded newlines in the parameter value, an attacker can break out of the `image:` field to inject arbitrary YAML keys and malicious configurations, such as commands to execute malicious containers.</p> <p>Exploitation of this vulnerability requires the following conditions to be met: - Attackers must obtain a valid cluster registration token (these tokens may be exposed, for example, through documentation, screenshots, or insecure communication channels). - The victim’s cluster operator must execute `kubectl apply` against a maliciously crafted URL.</p> <p>When a victim applies this compromised manifest using `kubectl apply`, a DaemonSet is deployed with the injected configuration. This DaemonSet: - Runs on all control-plane nodes with `hostNetwork: true` enabled. - Uses the `cattle` service account, which possesses `cluster-admin` privileges. - Mounts `/etc/kubernetes` directly from the host. - Executes attacker-controlled commands via the injected `command:` field.</p> <p>An attacker who successfully exploits this vulnerability could:</p> <p>- Achieve full control over downstream Kubernetes clusters. - Execute arbitrary code on control-plane nodes w…</p> https://cve.radiocsirt.org/vuln/ghsa-mhc6-2gfq-xx62 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1716 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um seine Privilegien zu erhöhen, Befehle zu injizieren und um Sicherheitsmechanismen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um seine Privilegien zu erhöhen, Befehle zu injizieren und um Sicherheitsmechanismen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1716