-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of the default admin user lifecycle during system initialization. While no direct code references are provided in the advisory, the described behavior suggests the existence of a bootstrap() function that: 1. Creates the default user on first start 2. Fails to properly check for prior deletion status during subsequent restarts 3. Recreates the user with known credentials when missing. The medium confidence reflects the lack of direct code references, but the pattern matches common initialization vulnerabilities where soft-deletion states aren't properly considered in bootstrap logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rancher/rancher | go | >= 2.0.0, <= 2.0.13 | |
| github.com/rancher/rancher | go | >= 2.1.0, <= 2.1.8 | |
| github.com/rancher/rancher | go | >= 2.2.0, < 2.2.2 | 2.2.2 |