CVE-2022-21951

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption of data transmitted via the network when a cluster is created from an RKE template with the CNI value overridden This issue affects: SUSE Rancher Rancher versions prior to 2.5.14; Rancher versions prior to 2.6.5.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
SUSE	Rancher	>= Rancher, < 2.5.14
SUSE	Rancher	>= Rancher, < 2.6.5

References

https://bugzilla.suse.com/show_bug.cgi?id=1199443Issue Tracking, Third Party Advisory
https://github.com/rancher/rancher/security/advisories/GHSA-vrph-m5jj-c46cExploit, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1199443Issue Tracking, Third Party Advisory
https://github.com/rancher/rancher/security/advisories/GHSA-vrph-m5jj-c46cExploit, Third Party Advisory

Timeline

Published: May 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022