CVE-2021-4200: Write access to the catalog for any user when restricted-admin role is enabled in Rancher
Summary
CVE-2021-4200: Write access to the catalog for any user when restricted-admin role is enabled in Rancher. Affects github.com/rancher/rancher across 2 version ranges.
>= 2.5.0, < 2.5.13
>= 2.6.0, < 2.6.4
Fixed in 2.5.13 or 2.6.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rancher is an open-source container management platform that allows users to deploy and manage containers in a Kubernetes cluster. It provides a user-friendly interface for managing applications and infrastructure. The vulnerability affects Rancher versions from 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3. The restricted-admin role in Rancher grants write access to the Catalogs, allowing users to modify templates and template versions. This vulnerability elevates the privilege of any user to write access for the catalog template and catalog template version resources.
Vulnerability Detail
The vulnerability arises from the global-data role in the cattle-global-data namespace, which grants write access to the Catalogs. Since each user with any level of catalog access was bound to the global-data role, this grants write access to templates and template versions for any user with any level of catalog access. Malicious users can exploit this vulnerability to make applications or individual versions of applications visible or hidden on the UI, change the logo of an application or template to an arbitrary image, make a chart appear as a trusted or partner chart, or swap template versions between templates of charts inside the same catalog. However, it does not allow injecting arbitrary data to charts that have already been pulled from their respective catalog.
How To Fix
Latest published version: v2.2.13+incompatible as of 23 Oct 2026
go get github.com/rancher/rancher@v2.2.13+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.5.0, < 2.5.132.5.13go get github.com/rancher/rancher@v2.5.13 -
>= 2.6.0, < 2.6.42.6.4go get github.com/rancher/rancher@v2.6.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no direct workaround for this vulnerability besides upgrading to the patched Rancher versions.
Conclusion
The vulnerability in Rancher allows users with catalog access to gain write access to the catalog template and catalog template version resources. Upgrading to the patched versions of Rancher is the recommended solution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/rancher/rancher →
FAQ
Rancher versions from 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3 are affected.
This vulnerability allows any user with catalog access to gain write access to the catalog template and catalog template version resources, enabling them to modify templates and template versions.
No, this vulnerability does not allow injecting arbitrary data to charts that have already been pulled from their respective catalog.
There are no direct workarounds for this vulnerability besides upgrading to the patched Rancher versions.
You can use Vulert's playground at Vulert Scanner to check if your Rancher installation is affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/rancher/rancher.
