{"api_version":"1","generated_at":"2026-07-24T00:19:44+00:00","cve":"CVE-2021-36782","urls":{"html":"https://cve.report/CVE-2021-36782","api":"https://cve.report/api/cve/CVE-2021-36782.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-36782","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-36782"},"summary":{"title":"CVE-2021-36782","description":"A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7.","state":"PUBLIC","assigner":"security@suse.com","published_at":"2022-09-07 09:15:00","updated_at":"2023-01-18 14:29:00"},"problem_types":["CWE-312"],"metrics":[],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1193988","name":"https://bugzilla.suse.com/show_bug.cgi?id=1193988","refsource":"CONFIRM","tags":[],"title":"Bug 1193988 – CVE-2021-36782: Rancher - Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/rancher/rancher/security/advisories/GHSA-g7j7-h4q8-8w2f","name":"https://github.com/rancher/rancher/security/advisories/GHSA-g7j7-h4q8-8w2f","refsource":"CONFIRM","tags":[],"title":"Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object · Advisory · rancher/rancher · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-36782","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36782","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Florian Struck (from Continum AG) and Marco Stuurman (from Shock Media B.V.)","lang":""}],"nvd_cpes":[{"cve_year":"2021","cve_id":"36782","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"suse","cpe5":"rancher","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@suse.com","DATE_PUBLIC":"2022-08-19T00:00:00.000Z","ID":"CVE-2021-36782","STATE":"PUBLIC","TITLE":"Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Rancher","version":{"version_data":[{"version_affected":"<","version_name":"Rancher","version_value":"2.5.16"}]}},{"product_name":"Rancher","version":{"version_data":[{"version_affected":"<","version_name":"Rancher","version_value":"2.6.7"}]}}]},"vendor_name":"SUSE"}]}},"credit":[{"lang":"eng","value":"Florian Struck (from Continum AG) and Marco Stuurman (from Shock Media B.V.)"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-312: Cleartext Storage of Sensitive Information"}]}]},"references":{"reference_data":[{"name":"https://bugzilla.suse.com/show_bug.cgi?id=1193988","refsource":"CONFIRM","url":"https://bugzilla.suse.com/show_bug.cgi?id=1193988"},{"name":"https://github.com/rancher/rancher/security/advisories/GHSA-g7j7-h4q8-8w2f","refsource":"CONFIRM","url":"https://github.com/rancher/rancher/security/advisories/GHSA-g7j7-h4q8-8w2f"}]},"source":{"advisory":"https://bugzilla.suse.com/show_bug.cgi?id=1193988","defect":["1193988"],"discovery":"EXTERNAL"}},"nvd":{"publishedDate":"2022-09-07 09:15:00","lastModifiedDate":"2023-01-18 14:29:00","problem_types":["CWE-312"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.1,"impactScore":6}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.0","versionEndExcluding":"2.6.7","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*","versionStartIncluding":"2.5.0","versionEndExcluding":"2.5.16","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"36782","Ordinal":"212337","Title":"CVE-2021-36782","CVE":"CVE-2021-36782","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"36782","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}