CVE-2019-13209

Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the cluster's Kubernetes API with the permissions and identity of the victim.

• CWE-79

• https://forums.rancher.com/c/announcementsRelease Notes, Vendor Advisory
• https://forums.rancher.com/t/rancher-release-v2-2-5-addresses-rancher-cve-2019-13209/14801Release Notes, Vendor Advisory
• https://forums.rancher.com/c/announcementsRelease Notes, Vendor Advisory
• https://forums.rancher.com/t/rancher-release-v2-2-5-addresses-rancher-cve-2019-13209/14801Release Notes, Vendor Advisory

Published

Sep 4, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13203Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.…8.8
• CVE-2019-13204Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.…9.8
• CVE-2019-13205All configuration parameters of certain Kyocera printers (su…7.5
• CVE-2019-13206Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.…8.8
• CVE-2019-13207nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buff…
• CVE-2019-13208WavesSysSvc in Waves MAXX Audio allows privilege escalation …
• CVE-2019-1321An elevation of privilege vulnerability exists when Windows …7.8
• CVE-2019-13217A heap buffer overflow in the start_decoder function in stb_…7.8
• CVE-2019-13218Division by zero in the predict_point function in stb_vorbis…5.5
• CVE-2019-13219A NULL pointer dereference in the get_window function in stb…5.5
• CVE-2019-1322An elevation of privilege vulnerability exists when Windows …7.8
• CVE-2019-13220Use of uninitialized stack variables in the start_decoder fu…7.1