GHSA-h99m-6755-rgwc · Severity: critical · Ecosystem: go — Rancher Remote Code Execution via Cluster/Node Drivers
A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root access to the Rancher container itself. In production environments, further privilege escalation is possible based on living off the land within the Rancher container itself. For the test and development environments, based on a –privileged Docker container, it is possible to escape the Docker container and gain execution access on the host system. This issue affects rancher: from 2.7.0 before 2.7.16, from 2.8.0 before 2.8.9, from 2.9.0 before 2.9.3.
Conclusion & alert: CVE-2024-22036 is rated Moderate Risk (50/100): CVSS Critical severity, with low exploitation likelihood (EPSS 0.17%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-02-10 | 0.12% | 0.17% | +0.05% |
| 2 | 2025-12-04 | 0.15% | 0.12% | -0.04% |
| 3 | 2025-12-03 | — | 0.15% | — |
Full EPSS history (7 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.1 | 3.1 | CRITICAL |
|
2.3 | 6.0 | [email protected] |
GHSA-h99m-6755-rgwc · Severity: critical · Ecosystem: go — Rancher Remote Code Execution via Cluster/Node Drivers
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| No affected products in dataset. | |||