CVE-2019-12274High· 8.8▾ TwilightRancher Privilege Escalation Vulnerability
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.1%
In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.
github.com/rancher/rancher >= 2.0.0, < 2.2.4github.com/rancher/rancher < 1.6.27Upgrade to a patched release:
github.com/rancher/rancher 2.2.4github.com/rancher/rancher 1.6.27Connected by shared product, vendor, weakness, or advisory.
CVE-2023-32196Critical· 9.1Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists
CVE-2025-23387Medium· 5.3Rancher's SAML-based login via CLI can be denied by unauthenticated users
CVE-2026-25705High· 8.4Rancher Extensions have arbitrary file access via path traversal
CVE-2024-52281High· 8.9Rancher UI has Stored Cross-site Scripting vulnerability
GHSA-wm2r-rp98-8pmhLowExposure of SSH credentials in Rancher/Fleet
CVE-2021-25320Critical· 9.9Rancher cloud credentials can be used through proxy API by users without access