CVE-2026-25705

Name of the Vulnerable Software and Affected Versions Rancher versions prior to 2.11.13 Rancher versions prior to 2.12.9 Rancher versions prior to 2.13.5 Rancher versions prior to 2.14.1

Description A path traversal issue exists in the UI plugin mechanism. Malicious code can be injected through the compressedEndpoint field inside a UIPlugin deployment. This allows a malicious UI extension to overwrite binaries or configurations, tamper with cluster state by writing to /var/lib/rancher/, or write to the host node filesystem if hostPath volumes are mounted. By default, this action requires administrator permissions or specifically granted user permissions.

Recommendations Update to version 2.11.13. Update to version 2.12.9. Update to version 2.13.5. Update to version 2.14.1.