CVE-2019-13209: Cross-Site Request Forgery (CSRF) in Rancher Server
Summary
CVE-2019-13209: Rancher Vulnerable to Cross-site Request Forgery (CSRF). Affects github.com/rancher/rancher across 3 version ranges.
>= 2.0.0, < 2.0.16
>= 2.1.0, < 2.1.11
>= 2.2.0, < 2.2.5
Fixed in 2.0.16, 2.1.11 or 2.2.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rancher Server is a management platform for Kubernetes clusters. It provides a user-friendly interface to manage and deploy containers. The vulnerability, identified as CVE-2019-13209, affects Rancher Server versions 2.0.0 to 2.2.4. It allows an attacker to perform a Cross-Site Websocket Hijacking attack, gaining unauthorized access to clusters managed by Rancher. The attack requires the victim to be logged into a Rancher server and visit a third-party site controlled by the attacker. Once successful, the attacker can execute commands against the cluster's Kubernetes API with the victim's permissions and identity.
Vulnerability Detail
The vulnerability arises from a Cross-Site Websocket Hijacking attack. By tricking a logged-in Rancher user into visiting a malicious site, the attacker can establish a WebSocket connection to the Rancher server. This connection allows the attacker to execute commands against the Kubernetes API with the victim's privileges. The impact of this vulnerability is significant as it grants unauthorized access to sensitive cluster resources, potentially leading to data breaches, unauthorized modifications, or disruption of services.
How To Fix
Latest published version: v2.2.13+incompatible as of 23 Oct 2026
go get github.com/rancher/rancher@v2.2.13+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.0.162.0.16go get github.com/rancher/rancher@v2.0.16 -
>= 2.1.0, < 2.1.112.1.11go get github.com/rancher/rancher@v2.1.11 -
>= 2.2.0, < 2.2.52.2.5go get github.com/rancher/rancher@v2.2.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the patched versions is the only recommended solution.
Conclusion
CVE-2019-13209 is a critical vulnerability in Rancher Server that allows for Cross-Site Websocket Hijacking attacks. Upgrading to the patched versions is the only recommended solution. It is essential to take immediate action to protect Rancher-managed clusters from unauthorized access and potential security breaches. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/rancher/rancher →
FAQ
The vulnerability allows an attacker to gain unauthorized access to Rancher-managed clusters, potentially leading to data breaches, unauthorized modifications, or disruption of services.
You can use the Vulert Playground at Vulert Scanner to check if your Rancher Server installation is affected by this vulnerability. No signup is required.
The only known mitigation is to upgrade Rancher Server to the patched versions mentioned in the 'how_to_fix' section.
Yes, this vulnerability can be exploited remotely by tricking a logged-in Rancher user into visiting a malicious site controlled by the attacker.
There is no evidence of active exploitation of this vulnerability at the time of this report. However, it is crucial to apply the necessary patches to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/rancher/rancher.
