{"id":"CVE-2021-25318","aliases":["GHSA-f9xf-jq4j-vqw4","GO-2024-2768"],"title":"Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources","summary":"Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"rancher","product":"github.com/rancher/rancher","ecosystem":"go","affected":["github.com/rancher/rancher >= 2.0.0, < 2.4.16","github.com/rancher/rancher >= 2.5.0, < 2.5.9"],"patched":["github.com/rancher/rancher 2.4.16","github.com/rancher/rancher 2.5.9"],"published":"2024-04-24","updated":"2026-07-10","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-f9xf-jq4j-vqw4","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25318"},{"url":"https://github.com/rancher/rancher/issues/33590"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1184913"},{"url":"https://github.com/rancher/rancher"},{"url":"https://pkg.go.dev/vuln/GO-2024-2768"}],"tags":["osv","go"],"epss":0.01051,"epssPercentile":0.62817,"ingestedAt":"2026-07-10T18:56:50.778Z","slug":"CVE-2021-25318","body":"## Overview\n\nA vulnerability was discovered in Rancher versions 2.0 through the aforementioned fixed versions, where users were granted access to resources regardless of the resource's API group. For example Rancher should have allowed users access to `apps.catalog.cattle.io`, but instead incorrectly gave access to `apps.*`. Resource affected include: \n\n**Downstream clusters:**\napiservices\nclusters\nclusterrepos\npersistentvolumes\nstorageclasses\n\n**Rancher management cluster**\napprevisions\napps\ncatalogtemplates\ncatalogtemplateversions\nclusteralertgroups\nclusteralertrules\nclustercatalogs\nclusterloggings\nclustermonitorgraphs\nclusterregistrationtokens\nclusterroletemplatebindings\nclusterscans\netcdbackups\nnodepools\nnodes\nnotifiers\npipelineexecutions\npipelines\npipelinesettings\npodsecuritypolicytemplateprojectbindings\nprojectalertgroups\nprojectalertrules\nprojectcatalogs\nprojectloggings\nprojectmonitorgraphs\nprojectroletemplatebindings\nprojects\nsecrets\nsourcecodeproviderconfigs\n\nThere is not a direct mitigation besides upgrading to the patched Rancher versions.\n\n## Affected packages\n\n- `github.com/rancher/rancher >= 2.0.0, < 2.4.16`\n- `github.com/rancher/rancher >= 2.5.0, < 2.5.9`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/rancher/rancher 2.4.16`\n- `github.com/rancher/rancher 2.5.9`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}