CVE-2019-11202
highpriority · track · 40EPSS 0.016 · 76 %ileEUUSEPSS · scored 2026-10-27
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
- Go github.com/rancher/rancher2.0.0+incompatible → 2.2.2+incompatibleosvUSpkg:golang/github.com/rancher/rancher
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-xh8x-j8h3-m5phRancher Recreates Default User With Known Password Despite Deletion2022-05-24ghsa · osvUS
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.
- GO-2024-2784Rancher Recreates Default User With Known Password Despite Deletion in github.com/rancher/rancher2024-06-10vendor · osvUS
Rancher Recreates Default User With Known Password Despite Deletion in github.com/rancher/rancher
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://forums.rancher.com/c/announcementscnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-11202cnnvd
- https://rancher.com/docs/rancher/v2.x/en/security/cnnvd
- https://forums.rancher.com/c/announcementsenisa_euvd
- https://rancher.com/docs/rancher/v2.x/en/security/enisa_euvd
- https://forums.rancher.com/c/announcementsRelease NotesVendor Advisorynvd
- https://rancher.com/docs/rancher/v2.x/en/security/Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan