---
id: CVE-2021-25318
aliases:
  - GHSA-f9xf-jq4j-vqw4
  - GO-2024-2768
title: >-
  Rancher does not properly specify ApiGroup when creating Kubernetes RBAC
  resources
summary: >-
  Rancher does not properly specify ApiGroup when creating Kubernetes RBAC
  resources
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: rancher
product: github.com/rancher/rancher
ecosystem: go
affected:
  - 'github.com/rancher/rancher >= 2.0.0, < 2.4.16'
  - 'github.com/rancher/rancher >= 2.5.0, < 2.5.9'
patched:
  - github.com/rancher/rancher 2.4.16
  - github.com/rancher/rancher 2.5.9
published: '2024-04-24'
updated: '2026-07-10'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-f9xf-jq4j-vqw4'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-25318'
  - url: 'https://github.com/rancher/rancher/issues/33590'
  - url: 'https://bugzilla.suse.com/show_bug.cgi?id=1184913'
  - url: 'https://github.com/rancher/rancher'
  - url: 'https://pkg.go.dev/vuln/GO-2024-2768'
tags:
  - osv
  - go
epss: 0.01051
epssPercentile: 0.62761
ingestedAt: '2026-07-10T18:56:50.778Z'
---

## Overview

A vulnerability was discovered in Rancher versions 2.0 through the aforementioned fixed versions, where users were granted access to resources regardless of the resource's API group. For example Rancher should have allowed users access to `apps.catalog.cattle.io`, but instead incorrectly gave access to `apps.*`. Resource affected include: 

**Downstream clusters:**
apiservices
clusters
clusterrepos
persistentvolumes
storageclasses

**Rancher management cluster**
apprevisions
apps
catalogtemplates
catalogtemplateversions
clusteralertgroups
clusteralertrules
clustercatalogs
clusterloggings
clustermonitorgraphs
clusterregistrationtokens
clusterroletemplatebindings
clusterscans
etcdbackups
nodepools
nodes
notifiers
pipelineexecutions
pipelines
pipelinesettings
podsecuritypolicytemplateprojectbindings
projectalertgroups
projectalertrules
projectcatalogs
projectloggings
projectmonitorgraphs
projectroletemplatebindings
projects
secrets
sourcecodeproviderconfigs

There is not a direct mitigation besides upgrading to the patched Rancher versions.

## Affected packages

- `github.com/rancher/rancher >= 2.0.0, < 2.4.16`
- `github.com/rancher/rancher >= 2.5.0, < 2.5.9`

## Remediation

Upgrade to a patched release:

- `github.com/rancher/rancher 2.4.16`
- `github.com/rancher/rancher 2.5.9`