Skip to content
Heist/ feed
Back to feed
Critical

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-36783

A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, passwords and API tokens that have been stored in cleartext and exposed via API endpoints. This issue affects: SUSE Rancher Rancher versions prior to 2.6.4; Rancher versions prior to 2.5.13.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-36783
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 11:50 UTC · Revision 1

Source evidence

CVE-2021-36783

core-osv · Original source

Published 7 Sept 2022, 09:15 UTC

A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, passwords and API tokens that have been stored in cleartext and exposed via API endpoints. This issue affects: SUSE Rancher Rancher versions prior to 2.6.4; Rancher versions prior to 2.5.13.

osv:CVE-2021-36783
Complete source record
{
  "id": "96479212642b5adf3c148171bf263f3e3101eb129cc48f0c76abdfbc7616f9ce",
  "url": "https://osv.dev/vulnerability/CVE-2021-36783",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-36783",
    "summary": "A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, passwords and API tokens that have been stored in cleartext and exposed via API endpoints. This issue affects: SUSE Rancher Rancher versions prior to 2.6.4; Rancher versions prior to 2.5.13.",
    "evidence": "osv:CVE-2021-36783",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2021-36783",
      "aliases": [
        "CVE-2021-36783",
        "GHSA-8w87-58w6-hfv8"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/rancher/rancher",
              "type": "GIT",
              "events": [
                {
                  "introduced": "65f3525cdc1167872af4140d45f3153698450c52"
                },
                {
                  "fixed": "7218c48a6f516b72ec4586a790b3b9f1e1fe792b"
                },
                {
                  "introduced": "df2432ad895c9d6be0e47e0d6d62a4c3dc8f08e5"
                },
                {
                  "fixed": "8eb8c3280aeb31eff311452b9c7f6a8ff674ed57"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "2.5.0"
                      },
                      {
                        "fixed": "2.5.13"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "2.6.0"
                      },
                      {
                        "fixed": "2.6.4"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.6.5-rc12",
            "v2.6.5",
            "v2.6.6-rc1",
            "v2.6.5-rc11",
            "v2.6.5-rc10",
            "v2.6.5-rc9",
            "v2.6.5-rc8",
            "v2.6.5-rc6",
            "v2.6.5-rc5",
            "v2.6.5-rc4",
            "v2.6.5-rc3",
            "v2.6.5-rc2",
            "v2.6.4-rc11",
            "v2.6.5-rc1",
            "v2.5.13-rc3",
            "v2.5.13-rc2",
            "v2.5.13-rc1",
            "v2.6.4-rc13",
            "v2.6.4-rc12",
            "v2.6.4-rc10",
            "v2.6.4-rc9",
            "v2.6.4-rc8",
            "v2.5.12-rc8",
            "v2.5.12",
            "v2.6.4-rc5",
            "v2.6.4-rc6",
            "v2.5.6-rc9",
            "v2.5.6",
            "v2.6.4-rc4",
            "v2.6.4-rc3",
            "v2.6.4-rc2",
            "v2.6.4-rc1",
            "v2.6.4-alpha3",
            "v2.5.12-rc7",
            "v2.6.4-alpha2",
            "v2.6.5-alpha1",
            "v2.6.4-alpha1",
            "v2.5.12-rc6",
            "v2.5.12-rc5",
            "v2.5.12-rc4",
            "v2.6.3-rc11",
            "v2.6.3-harvester1",
            "v2.6.3",
            "v2.5.12-rc3",
            "v2.5.12-rc2",
            "v2.5.12-rc1",
            "v2.6.3-rc10",
            "v2.6.3-rc9",
            "v2.6.3-rc8",
            "v2.6.3-rc7",
            "v2.6.3-rc6",
            "v2.6.3-rc5",
            "v2.6.3-rc4",
            "v2.6.3-rc3",
            "v2.6.3-rc2",
            "v2.6.3-rc1",
            "v2.5.10-rc7",
            "v2.5.10",
            "v2.6.1-rc13",
            "v2.6.1-harvester2",
            "v2.6.1",
            "v2.5.10-rc6",
            "v2.5.10-rc5",
            "v2.6.1-rc12",
            "v2.5.10-rc4",
            "v2.5.10-rc3",
            "v2.6.1-harvester1",
            "v2.5.10-rc2",
            "v2.6.1-rc11",
            "v2.6.1-rc9",
            "v2.6.1-rc10",
            "v2.6.1-rc2",
            "v2.6.1-rc8",
            "v2.6.1-rc7",
            "v2.6.1-rc6",
            "v2.6.1-rc5",
            "v2.6.1-rc4",
            "v2.6.1-rc3",
            "v2.5.10-rc1",
            "v2.6.1-rc1",
            "v2.6.0-rc10",
            "v2.6.0",
            "v2.5.8-rc21",
            "v2.5.8-rc20",
            "v2.5.8",
            "v2.5.8-rc18",
            "v2.5.8-rc19",
            "v2.5.8-rc17",
            "v2.5.8-rc16",
            "v2.5.8-rc15",
            "v2.5.8-rc14",
            "v2.5.8-rc13",
            "v2.5.8-rc12",
            "v2.5.8-rc11",
            "v2.5.8-rc10",
            "v2.5.8-rc9",
            "v2.5.8-rc8",
            "v2.5.8-rc3",
            "v2.5.8-rc7",
            "v2.5.8-rc6",
            "v2.5.8-rc5",
            "v2.5.8-rc4",
            "v2.5.8-rc2",
            "v2.5.6-rc5",
            "v2.5.6-rc8",
            "v2.5.6-rc7",
            "v2.5.6-rc6",
            "v2.5.6-rc4",
            "v2.5.6-rc3",
            "v2.5.6-rc2",
            "v2.5.6-rc1",
            "v2.5.4-rc9",
            "v2.5.4",
            "v2.5.4-rc8",
            "v2.5.4-rc7",
            "v2.5.4-rc6",
            "v2.5.4-rc5",
            "v2.5.4-rc4",
            "v2.5.4-rc3",
            "v2.5.4-rc2",
            "v2.5.4-rc1",
            "v2.5.2-rc10",
            "v2.5.2",
            "v2.5.2-rc9",
            "v2.5.2-rc8",
            "v2.5.2-rc7",
            "v2.5.2-rc6",
            "v2.5.2-rc5",
            "v2.5.2-rc4",
            "v2.5.2-rc3",
            "v2.5.1-rc1",
            "v2.5.1",
            "v2.5.2-rc1",
            "v2.5.2-rc2",
            "v2.5.2-rc",
            "v2.5.0-rc9",
            "v2.5.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-36783.json"
          }
        }
      ],
      "modified": "2026-10-20T10:54:48.472481502Z",
      "provider": "osv",
      "references": [
        "https://github.com/rancher/rancher/security/advisories/GHSA-8w87-58w6-hfv8",
        "https://bugzilla.suse.com/show_bug.cgi?id=1193990"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-36783",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 386173,
  "published_at": "2022-09-07T09:15:08.6+00:00"
}