Missing Encryption of Sensitive Data Affecting github.com/rancher/rancher/pkg/controllers/management/node package, versions >=2.5.0 <2.5.14>=2.6.0 <2.6.5
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Missing Encryption of Sensitive Data vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GITHUBCOMRANCHERRANCHERPKGCONTROLLERSMANAGEMENTNODE-15435610
- published6 Mar 2026
- disclosed3 Mar 2026
- creditUnknown
Introduced: 3 Mar 2026
CVE-2022-21951 Â (opens in a new tab)How to fix?
Upgrade github.com/rancher/rancher/pkg/controllers/management/node to version 2.5.14, 2.6.5 or higher.
Overview
github.com/rancher/rancher/pkg/controllers/management/node is a complete container management platform
Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data in the cluster creation using RKE templates with Weave CNI, where the WEAVE_PASSWORD is not set, resulting in unencrypted network traffic within the cluster. An attacker can intercept sensitive data by monitoring network communications between cluster nodes.
Note:
This is only exploitable if Weave CNI is configured via an RKE template and no password is set for network encryption.
Workaround
This vulnerability can be mitigated by manually setting a strong WEAVE_PASSWORD environment variable in the Weave DaemonSet or by creating a new RKE template revision that properly generates the Weave password.