https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:34:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-195976 EUVD-2026-195976 https://cve.radiocsirt.org/vuln/euvd-2026-195976 https://cve.radiocsirt.org/vuln/fkie_cve-2023-22650 <p>A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.</p> <p>A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-22650 https://cve.radiocsirt.org/vuln/ghsa-9ghh-mmcq-8phc <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact</p> <p>A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.</p> <p>An AP must be enabled to be affected by this, as the built-in User Management feature is not affected by this vulnerability. This issue may lead to an adversary gaining unauthorized access, as the user’s access privileges may still be active within Rancher even though they are no longer valid on the configured AP (please consult the [MITRE ATT&amp;CK - Technique - Valid Accounts](https://attack.mitre.org/techniques/T1078/) for further information about the associated technique of attack).</p> <p>It’s important to note that all configurable APs are impacted, see [Rancher Docs - Configuring Authentication - External vs. Local Authentication](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config#external-vs-local-authentication) to get the full authentication providers list.</p> <p>To address this issue, the fix introduces a new user retention process that can be configured to run periodically and disable and/or delete inactive users. If enabled a user becomes subject to retention if they don&#39;t login for a configurable period of time. It&#39;s possible to set overrides for users t…</p> <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact</p> <p>A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.</p> <p>An AP must be enabled to be affected by this, as the built-in User Management feature is not affected by this vulnerability. This issue may lead to an adversary gaining unauthorized access, as the user’s access privileges may still be active within Rancher even though they are no longer valid on the configured AP (please consult the [MITRE ATT&amp;CK - Technique - Valid Accounts](https://attack.mitre.org/techniques/T1078/) for further information about the associated technique of attack).</p> <p>It’s important to note that all configurable APs are impacted, see [Rancher Docs - Configuring Authentication - External vs. Local Authentication](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config#external-vs-local-authentication) to get the full authentication providers list.</p> <p>To address this issue, the fix introduces a new user retention process that can be configured to run periodically and disable and/or delete inactive users. If enabled a user becomes subject to retention if they don&#39;t login for a configurable period of time. It&#39;s possible to set overrides for users t…</p> https://cve.radiocsirt.org/vuln/ghsa-9ghh-mmcq-8phc https://cve.radiocsirt.org/vuln/gsd-2023-22650 gsd-2023-22650 https://cve.radiocsirt.org/vuln/gsd-2023-22650 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1397 <p>Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Dateien zu manipulieren, seine Privilegien zu erweitern oder vertrauliche Informationen offenzulegen.</p> <p>Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Dateien zu manipulieren, seine Privilegien zu erweitern oder vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1397