CVE-2021-36783: Rancher Credential Exposure in Cluster Template Answers
Summary
CVE-2021-36783: Rancher doesn't properly sanitize credentials in cluster template answers. Affects github.com/rancher/rancher across 2 version ranges.
>= 2.5.0, < 2.5.13
>= 2.6.0, < 2.6.4
Fixed in 2.5.13 or 2.6.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rancher is an open-source platform designed for managing Kubernetes clusters. It provides a user-friendly interface for deploying and managing containerized applications across multiple clusters. However, certain versions of Rancher have a critical vulnerability that allows for improper handling of sensitive credentials, potentially exposing them to unauthorized users.
Vulnerability Detail
The vulnerability arises from a failure to properly sanitize credentials in cluster template answers within Rancher versions up to and including 2.5.12 and 2.6.3. This oversight can lead to the plaintext storage of sensitive information such as passwords and API tokens. The exposed credentials can be accessed by authenticated users with roles such as Cluster Owners, Cluster Members, Project Owners, and Project Members, thereby increasing the risk of unauthorized access to critical services.
How To Fix
Latest published version: v2.2.13+incompatible as of 23 Oct 2026
go get github.com/rancher/rancher@v2.2.13+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.5.0, < 2.5.132.5.13go get github.com/rancher/rancher@v2.5.13 -
>= 2.6.0, < 2.6.42.6.4go get github.com/rancher/rancher@v2.6.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, limit access in Rancher to trusted users only. This can help mitigate the risk of credential exposure until the upgrade to a patched version is completed.
Conclusion
The vulnerability CVE-2021-36783 in Rancher poses a significant risk due to the improper handling of sensitive credentials. It is essential for users to upgrade to the patched versions to mitigate this risk and ensure the security of their Kubernetes clusters.
See every vulnerability recorded for github.com/rancher/rancher →
FAQ
CVE-2021-36783 is a vulnerability in Rancher that allows for the improper handling of sensitive credentials, leading to potential exposure.
Rancher versions up to and including 2.5.12 and 2.6.3 are affected by this vulnerability.
If you are using an affected version, it is crucial to upgrade to the patched versions 2.5.13 or 2.6.4 or later as soon as possible.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of this vulnerability is 9.9, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/rancher/rancher.
