VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/rancher/rancher: vulnerability history, versions and safety

github.com/rancher/rancher is a package in the Go ecosystem. Vulert records 103 vulnerabilities for it across 120 releases, from May 2021 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
103 vulnerabilities recorded C12 H37 M12 L1 U41
i
30 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
25 in the last 12 months

Most recent disclosure 07 Jul 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/rancher/rancher vulnerabilities

Vulert verdict on github.com/rancher/rancher v2.2.13+incompatible i

Updated on 23 Oct 2026

Careful: 30 of the 103 vulnerabilities Vulert records for this package have no fix yet. Plan around those, or apply the workaround listed for each. The rest have a fixed version to move to.

Package health score 64/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

What to do: Plan around the 30 vulnerabilities with no published fix: each lists the affected range and any workaround that reduces exposure. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v2.2.13+incompatible — unaffected i
  • Vulnerabilities on record 103 over 5 years · 25 in the last year i
  • Latest disclosure 07 Jul 2026 i
  • Highest CVSS 9.9 i
  • With no published fix 30 i
  • Stars 25,993 i
  • OpenSSF scorecard 7/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/rancher/rancher, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261022225600-7b1f21008e6f 22 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261022185748-21aa93656bdc 22 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261022134543-ad907b74f54b 22 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261022101401-af9a251cdb99 22 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261022072040-a83e938847a3 22 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021233803-8f4f53957ebc 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021233726-fc8cc5d80415 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021233713-889264a003f7 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021211005-e8d3faea3cf1 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021200352-b34b29dc1a5f 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021180926-7da04b1404b0 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021163832-c49dad3ae093 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021150615-81265d75aee6 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021150258-5c8a802c3cb2 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021135255-6566595c8b0c 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021125443-c59dfeee43da 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021090205-a3af136a41b6 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021085516-389ec4d2ff58 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021085428-addce413702d 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021085414-f38f7b176540 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021085358-f7c248eb6f6b 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021085047-dcf17c8b87d6 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021085019-1c5b79e360db 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261021010210-7c43ea8b5235 21 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261020215846-42e3d65058dc 20 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261020201023-45627d70d72c 20 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261020163623-c08eec526242 20 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261020145915-ea0d3288f136 20 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261020142553-2f0100f15d8c 20 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261020130620-263e063c58bc 20 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261020115644-1b52b433dcba 20 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261020113656-3dd0ef87698b 20 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261020081412-696a3c628ddb 20 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261020081258-8f2298f471f5 20 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261020080816-83faa186ba0a 20 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261020045555-ba4df6d6ef0e 20 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261019233649-c30cda6cda4b 19 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261019221108-ae8a9b954c93 19 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261019193604-466f11baf045 19 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261019185222-a46ecf96c4e3 19 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261019180847-237b742de1cb 19 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261019155810-5cc1d6f590b1 19 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261019152729-68118928debe 19 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261019151543-703d42c22956 19 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261019150348-ab5507bd4549 19 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261019141209-d513177e119c 19 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261017021245-aa3fd3c86739 17 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016231242-33a7263ab3fe 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016230632-701d44733bfc 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016230249-da3e07a568df 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016223037-a5353596c473 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016210059-318bac26a131 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016205018-179b3b38ce4a 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016203502-0afc6665dea2 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016151715-a743ea4f2953 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016150404-c7557a0b585c 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016150332-fee94e7492b2 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016140414-0f68322946a6 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016064454-7027cb694472 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016064444-44b22a74abc0 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016064432-4afed46c0ae7 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016064420-088e1740d840 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016064403-71601340118f 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261016032542-6fc3d7292007 16 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261015232521-b4969b16b19a 15 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261015205351-88e9c2fda635 15 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261015184111-778ff4b42ebd 15 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261015181233-9654ba54dac2 15 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261015171156-656e7cbdf973 15 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261015152254-25319026d1ac 15 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261015151248-82b5f0129e92 15 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261015150348-909698d41a49 15 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261015142759-14f1e5b54bfa 15 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261014203801-b63edb00b372 14 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261014175509-a94c193ab10a 14 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261014160431-7c1cdf759ff3 14 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261014160426-cc1c93545067 14 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261014152552-49efea50a03b 14 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261014145538-1fef45cf6117 14 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261014141944-a8ac9dc7300c 14 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261014134643-5ce9b928a957 14 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261014133703-1fb0bcc2d2e7 14 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261014125654-b9044feab228 14 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261014073818-3a7c9241500c 14 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261014051848-043a9a415a02 14 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013193606-16d985572933 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013185855-ffe08fdd2c69 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013173922-bc2fc62403c8 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013155913-64aa670e3304 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013155910-2b804465a811 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013155901-a232231d324b 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013151215-8d87d3b8d091 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013143527-614a6e6c18f4 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013143316-8d522dac1e13 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013143126-a7d81925d8c7 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013142011-5b9548bb2140 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013135545-2a9aaaeee5c9 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013133315-801faa1271c1 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013120608-2db45b81900a 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013120537-019fd5e0aa26 13 Oct 2026 H2 M3 L1 U32 Apache-2.0 No Details →
v0.0.0-20261013104746-9e832d9d0511 13 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261013104307-7ec6f0a210e0 13 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261013093551-94c5e9770e53 13 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261013045907-d2aa4ce571eb 13 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261013045858-1eebe9dd47e4 13 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261013045852-b7f87562834d 13 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261013045845-a72163669f88 13 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261012193746-3d1976c9ce92 12 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261012183550-297dec12b227 12 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261012180657-a9794f18f737 12 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261012152740-0ccc851f077e 12 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261012114801-c5037cac7be4 12 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261012114429-a8a7f7a6b4b1 12 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261012114310-f5ef441ea00c 12 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261012082016-7d7fb882d46b 12 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261012042856-16663554ca0d 12 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261012042847-687e7fd9f0c8 12 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261012042834-41629ab052a7 12 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261010041258-175b2664db10 10 Oct 2026 H2 M3 L1 U32 — No Details →
v0.0.0-20261010004148-17468569340c 10 Oct 2026 H2 M3 L1 U32 — No Details →

The newest 120 of 12,758 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 3
  • 2022 13
  • 2023 10
  • 2024 35
  • 2025 24
  • 2026 18

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 25 of the 103 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/rancher/rancher

The 5 most severe of 103 vulnerabilities recorded for this package

Search all 103 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2021-25320: Rancher Cloud Credentials Misuse via Proxy API 9.9 critical 2.4.16 03 Mar 2026
CVE-2021-36783: Rancher Credential Exposure in Cluster Template Answers 9.9 critical 2.5.13 03 Mar 2026
CVE-2023-22651: Rancher Webhook Misconfiguration during Upgrade Process 9.9 critical 2.7.3 24 Apr 2023
CVE-2021-36782: Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials 9.9 critical 2.5.16 23 Sep 2022
CVE-2023-22647: Privilege Escalation in Rancher via Manipulation of Secrets 9.9 critical 2.6.13 06 Jun 2023

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/rancher/rancher

Is github.com/rancher/rancher safe to use?

Vulert records 103 vulnerabilities for github.com/rancher/rancher in Go: 12 critical, 37 high, 12 medium and 1 low, plus 41 not yet rated. 30 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/rancher/rancher's Vulert package health score?

Vulert scores github.com/rancher/rancher 64/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Which version of github.com/rancher/rancher should I use?

v1.6.30 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/rancher/rancher have?

103 vulnerabilities are recorded for github.com/rancher/rancher in the Go ecosystem: 12 critical, 37 high, 12 medium and 1 low, plus 41 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/rancher/rancher vulnerabilities disclosed?

25 vulnerabilities were recorded for github.com/rancher/rancher in the last 12 months, and the oldest entry in this database dates to 18 May 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/rancher/rancher are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/rancher/rancher for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/rancher/rancher version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.