Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2024-22032

Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling, the Kube API secret values are written in plaintext on the AppliedSpec. Cluster owners, Cluster members, and Project members (for projects within the cluster), all have RBAC permissions to view the cluster object from the apiserver.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE rancher

Default version status: unaffected

  • 2.7.0 to < 2.7.14affected
  • 2.8.0 to < 2.8.5affected

References