CVE-2019-13209
mediumpriority · track · 24EPSS 0.011 · 65 %ileEUUSEPSS · scored 2026-10-27
Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the cluster's Kubernetes API with the permissions and identity of the victim.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.3–8.7
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (6)
Products and version ranges known to be affected.
- Go github.com/rancher/rancher< 2.2.5-rc6.0.20190621200032-0ddffe484adc+incompatibleosvUSpkg:golang/github.com/rancher/rancher
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-xhg2-rvm8-w2jhRancher Vulnerable to Cross-site Request Forgery (CSRF)2021-05-18ghsa · osvUS
Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the cluster's Kubernetes API with the permissions and identity of the victim.
- GO-2022-0755Cross-site request forgery in github.com/rancher/rancher2021-05-18vendor · osvUS
Rancher 2 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://forums.rancher.com/c/announcementscnnvd
- https://forums.rancher.com/t/rancher-release-v2-2-5-addresses-rancher-cve-2019-13209/14801cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-13209cnnvd
- https://forums.rancher.com/c/announcementsenisa_euvd
- https://forums.rancher.com/t/rancher-release-v2-2-5-addresses-rancher-cve-2019-13209/14801enisa_euvd
- https://forums.rancher.com/c/announcementsRelease NotesVendor Advisorynvd
- https://forums.rancher.com/t/rancher-release-v2-2-5-addresses-rancher-cve-2019-13209/14801Release NotesVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan