CVE-2024-22036 Rancher Remote Code Execution via Cluster/Node Drivers

Critical 9.1 Published 16 Apr 2025 Updated 26 Feb 2026

Attackers can escape chroot and Docker containers via cluster drivers to gain root access on the host or Rancher container.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-22036?

CVE-2024-22036 is a critical vulnerability in SUSE rancher, published on 16 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root access to the Rancher container itself. In production environments, further privilege escalation is possible based on living off the land within the Rancher container itself. For the test and development environments, based on a –privileged Docker container, it is possible to escape the Docker container and gain execution access on the host system.

This issue affects rancher: from 2.7.0 before 2.7.16, from 2.8.0 before 2.8.9, from 2.9.0 before 2.9.3.

Weakness: CWE-269

Which versions are affected by CVE-2024-22036?

7 open source packages ship an affected version, including github.com/rancher/rancher.

Package	Affected	Fixed in
`github.com/rancher/rancher` Go	All versions	None
`github.com/rancher/rancher` Go	From `2.7.0`	`2.7.16`
`github.com/rancher/rancher` Go	From `2.7.0`	`2.7.16`
`github.com/rancher/rancher` Go	From `2.8.0`	`2.8.9`
`github.com/rancher/rancher` Go	From `2.8.0`	`2.8.9`
`github.com/rancher/rancher` Go	From `2.9.0`	`2.9.3`

1 more packages

github.com/rancher/rancher Go From 2.9.0 2.9.3

How do I fix CVE-2024-22036?

Upgrade github.com/rancher/rancher to a fixed version for your release line: 2.7.16, 2.8.9 or 2.9.3.

Is CVE-2024-22036 being exploited?

There is no known exploitation of CVE-2024-22036 in the wild and no public exploit code.

Sources

Also known as GHSA-h99m-6755-rgwc, GO-2024-3221.