CVE-2021-31999: Rancher: Privilege escalation vulnerability via malicious Connection header

Published Jul 15, 2021
·
Updated

A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16.

Other sources

A vulnerability was discovered in Rancher 2.0.0 through the aforementioned patched versions, where a malicious Rancher user could craft an API request directed at the proxy for the Kubernetes API of a managed cluster to gain access to information they do not have access to. This is done by passing the "Impersonate-User" or "Impersonate-Group" header in the Connection header, which is then correctly removed by the proxy. At this point, instead of impersonating the user and their permissions, the request will act as if it was from the Rancher management server and incorrectly return the information. The vulnerability is limited to valid Rancher users with some level of permissions on the cluster. There is not a direct mitigation besides upgrading to the patched Rancher versions.

GitHub

Affected Software

4 affected componentsFixes available
go/github.com/rancher/rancher>=2.5.0<2.5.9
2.5.9
go/github.com/rancher/rancher>=2.0.0<2.4.16
2.4.16
Rancher Rancher<2.4.16
Rancher Rancher>=2.5.0<2.5.9

Event History

Jul 15, 2021
CVE Published
via MITRE·08:55 AM
Data Sourced
via MITRE·08:55 AM
DescriptionSeverityWeakness
Apr 24, 2024
Advisory Published
via GitHub·09:01 PM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2021-31999?

CVE-2021-31999 is classified as a critical vulnerability that allows users in a Rancher cluster to impersonate other users.

2

How do I fix CVE-2021-31999?

To fix CVE-2021-31999, upgrade your Rancher installation to version 2.5.9 or later for 2.5.x versions or to version 2.4.16 or later for 2.4.x versions.

3

Which versions of Rancher are affected by CVE-2021-31999?

Rancher versions prior to 2.5.9 and 2.4.16 are affected by CVE-2021-31999.

4

What types of attacks can CVE-2021-31999 enable?

CVE-2021-31999 can enable attackers to perform unauthorized actions by impersonating other users within the Rancher cluster.

5

Is there a known mitigation for CVE-2021-31999?

The only known mitigation for CVE-2021-31999 is to upgrade to the fixed versions provided by Rancher.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203