cve.bz

CVE-2022-21951

6.8 mediumEPSS 0.4%

Medium (6.8) in suse rancher. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/rancher/rancher 2.5.14, 2.6.5.

A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption of data transmitted via the network when a cluster is created from an RKE template with the CNI value overridden This issue affects: SUSE Rancher Rancher versions prior to 2.5.14; Rancher versions prior to 2.6.5.

Severity

CVSS 3.1

6.8 medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE
CWE-319
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-vrph-m5jj-c46cGogithub.com/rancher/rancher>=2.6.0 <2.6.52.6.5
GHSA-vrph-m5jj-c46cGogithub.com/rancher/rancher>=2.5.0 <2.5.142.5.14

References

Check your stackJSON