A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, passwords and API tokens that have been stored in cleartext and exposed via API endpoints. This issue affects: SUSE Rancher Rancher versions prior to 2.6.4; Rancher versions prior to 2.5.13.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSUSE Rancher
APPSuse2.5.0 – 2.5.13 (excl.)2.6.0 – 2.6.4 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2026-44946CRITICAL9.5PL ✓same product
SAML authentication replay w Rancher — brak wymuszenia jednorazowego użycia asercji
CVE-2026-41052CRITICAL9.4PL ✓same product
Eskalacja uprawnień dla roli Project Owner w Rancher (LPE)
CVE-2023-22647CRITICAL9.9PL ✓same product
SUSE Rancher: eskalacja uprawnień przez manipulację Kubernetes secrets
CVE-2023-22651CRITICAL9.9PL ✓same product
SUSE Rancher – privilege escalation przez błędną konfigurację admission Webhook
CVE-2022-43757CRITICAL9.9PL ✓same product
SUSE Rancher: przechowywanie poświadczeń w postaci jawnego tekstu