https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 05:51:29 +0000 https://cve.radiocsirt.org/vuln/cnvd-2022-65015 cnvd-2022-65015 https://cve.radiocsirt.org/vuln/cnvd-2022-65015 https://cve.radiocsirt.org/vuln/euvd-2026-185202 EUVD-2026-185202 https://cve.radiocsirt.org/vuln/euvd-2026-185202 https://cve.radiocsirt.org/vuln/fkie_cve-2021-36778 <p>A Incorrect Authorization vulnerability in SUSE Rancher allows administrators of third-party repositories to gather credentials that are sent to their servers. This issue affects: SUSE Rancher Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3.</p> <p>A Incorrect Authorization vulnerability in SUSE Rancher allows administrators of third-party repositories to gather credentials that are sent to their servers. This issue affects: SUSE Rancher Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-36778 https://cve.radiocsirt.org/vuln/ghsa-4fc7-hc63-7fjg <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact This issue only happens when the user configures access credentials to a private repository in Rancher inside `Apps &amp; Marketplace &gt; Repositories`. It affects Rancher versions 2.5.0 up to and including 2.5.11 and from 2.6.0 up to and including 2.6.2.</p> <p>An insufficient check of the same-origin policy when downloading Helm charts from a configured private repository can lead to exposure of the repository credentials to a third-party provider. This exposure happens when the private repository:</p> <p>1. Does an HTTP redirect to a third-party repository or external storage provider. 2. Downloads an icon resource for the chart hosted on a third-party provider.</p> <p>The address of the private repository is not leaked, only the credentials are leaked in the HTTP `Authorization` header in base64 format.</p> <p>With the patched versions, the default behavior now is to only send the private repository credentials when subdomain or domain hostname match when following the redirect or downloading external resources.</p> <p>### Patches Patched versions include releases 2.5.12, 2.6.3 and later versions.</p> <p>### Workarounds 1. Update Rancher to a patched version. 2. Check the Helm charts in your configured private repository for possible redirects to third-party storage, and for Helm chart icons from third-party sources. 3. Evaluate any Helm chart that might lead to the mentioned scenario and change affected credentials if deemed necessary.</p> <p>### References Information about the same-origin check and how t…</p> <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact This issue only happens when the user configures access credentials to a private repository in Rancher inside `Apps &amp; Marketplace &gt; Repositories`. It affects Rancher versions 2.5.0 up to and including 2.5.11 and from 2.6.0 up to and including 2.6.2.</p> <p>An insufficient check of the same-origin policy when downloading Helm charts from a configured private repository can lead to exposure of the repository credentials to a third-party provider. This exposure happens when the private repository:</p> <p>1. Does an HTTP redirect to a third-party repository or external storage provider. 2. Downloads an icon resource for the chart hosted on a third-party provider.</p> <p>The address of the private repository is not leaked, only the credentials are leaked in the HTTP `Authorization` header in base64 format.</p> <p>With the patched versions, the default behavior now is to only send the private repository credentials when subdomain or domain hostname match when following the redirect or downloading external resources.</p> <p>### Patches Patched versions include releases 2.5.12, 2.6.3 and later versions.</p> <p>### Workarounds 1. Update Rancher to a patched version. 2. Check the Helm charts in your configured private repository for possible redirects to third-party storage, and for Helm chart icons from third-party sources. 3. Evaluate any Helm chart that might lead to the mentioned scenario and change affected credentials if deemed necessary.</p> <p>### References Information about the same-origin check and how t…</p> https://cve.radiocsirt.org/vuln/ghsa-4fc7-hc63-7fjg https://cve.radiocsirt.org/vuln/gsd-2021-36778 gsd-2021-36778 https://cve.radiocsirt.org/vuln/gsd-2021-36778