CVE-2021-36778: 
Rancher vulnerability analysis and mitigation

A Incorrect Authorization vulnerability (CVE-2021-36778) was identified in SUSE Rancher that allows administrators of third-party repositories to gather credentials that are sent to their servers. This vulnerability affects SUSE Rancher versions prior to 2.5.12 and versions prior to 2.6.3. The vulnerability was discovered in July 2021 and publicly disclosed in April 2022 (SUSE Bug, NVD).

The vulnerability has been classified with CWE-863 (Incorrect Authorization) and received a CVSS v3.1 base score of 7.5 (HIGH) from NVD with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. SUSE's own assessment rated it slightly lower at 7.3 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (NVD).

The vulnerability allows administrators of third-party repositories to gather credentials that are sent to their servers, potentially compromising the security of the affected Rancher installations. This could lead to unauthorized access to sensitive information and potential system compromise (NVD).

Users should upgrade to SUSE Rancher version 2.5.12 or later for the 2.5.x series, or version 2.6.3 or later for the 2.6.x series. These versions contain the necessary fixes to address the vulnerability (NVD).