Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2023-32191

rke's credentials are stored in the RKE1 Cluster state ConfigMap

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE rke

Default version status: unaffected

  • 1.4.18 to < 1.4.19affected
  • 1.5.9 to < 1.5.10affected

References