Skip to content
Fencer Intel
critical 9.8

CVE-2019-11202 json

Rancher Recreates Default User With Known Password Despite Deletion

published 2019-07-30 7 y ago modified 2026-06-17 4 mo ago also GHSA-xh8x-j8h3-m5ph , GO-2024-2784 , EUVD-2022-5793

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.

Patch / fix

  • go github.com/rancher/rancher 2.2.2, 2.2.2+incompatible

Exploit prediction

1.60% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/rancher/rancher
>=2.0.0, <=2.0.13
>=2.1.0, <=2.1.8
>=2.2.0, <2.2.2
>=2.0.0+incompatible, <2.2.2+incompatible
2.2.2
2.2.2+incompatible

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.