TI-2022-21491 Aliases CVE-2022-43757 GHSA-cq4p-vp5q-4522

Rancher: Exposure of sensitive fields

MEDIUM 44CWE-312Published 2023-02-07 · Updated 2025-03-25

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-312.

Summary

A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00553 46th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Rancher (SUSE): 2.5.17github.com/rancher/rancher (Go): 2.5.17, 2.6.10, 2.7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SUSE	Rancher	Rancher to before 2.5.17	2.5.17	Patch available	CNA
—	github.com/rancher/rancher (Go)	2.5.0 to before 2.5.17	2.5.17	Patch available	GHSA-cq4p-vp5q-4522
—	github.com/rancher/rancher (Go)	2.6.0 to before 2.6.10	2.6.10	Patch available	GHSA-cq4p-vp5q-4522
—	github.com/rancher/rancher (Go)	2.7.0 to before 2.7.1	2.7.1	Patch available	GHSA-cq4p-vp5q-4522

Rancher VendorSUSE Affected Rancher to before 2.5.17 Fixed in 2.5.17 Patch available CNA
github.com/rancher/rancher (Go) Vendor— Affected 2.5.0 to before 2.5.17 Fixed in 2.5.17 Patch available GHSA-cq4p-vp5q-4522
github.com/rancher/rancher (Go) Vendor— Affected 2.6.0 to before 2.6.10 Fixed in 2.6.10 Patch available GHSA-cq4p-vp5q-4522
github.com/rancher/rancher (Go) Vendor— Affected 2.7.0 to before 2.7.1 Fixed in 2.7.1 Patch available GHSA-cq4p-vp5q-4522

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:suse:rancher::::::::	2.5.0 to before 2.5.17; 2.6.0 to before 2.6.10; 2.7.0 to before 2.7.1	Vulnerable	SUSE

cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.5.17; 2.6.0 to before 2.6.10; 2.7.0 to before 2.7.1 Vulnerable ·SUSE

Remediation

Fix · CNA Rancher (SUSE) Fixed in 2.5.17
Fix · GHSA-cq4p-vp5q-4522 github.com/rancher/rancher (Go) Fixed in 2.5.17 Advisory →
Fix · GHSA-cq4p-vp5q-4522 github.com/rancher/rancher (Go) Fixed in 2.6.10 Advisory →
Fix · GHSA-cq4p-vp5q-4522 github.com/rancher/rancher (Go) Fixed in 2.7.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-02-07
SUSE Rancher 2.5.17
4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2022-21493 Rancher: Privilege escalation via promoted rolesPriority MEDIUM 41
- TI-2022-06315 Authenticated user can gain unauthorized shell pod and kubectl access in the local clusterPriority LOW 38
- TI-2022-21492 Rancher: Command injection in Git packagePriority LOW 37
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-43757
2026-10-03 Alias added: GHSA-cq4p-vp5q-4522

References

Exploit 1

https://bugzilla.suse.com/show_bug.cgi?id=1205295

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-43757

Other 2

TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
TI-2022-21489 Rancher: Non-random authentication token CVSS 3.1CRITICAL 9.8
TI-2019-08380 An issue was discovered that affects the following versions of Rancher: v2.0.0 through… CVSS 3.0CRITICAL 9.8
TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
TI-2021-14904 Rancher: Failure to properly sanitize credentials in cluster template answers CVSS 3.1CRITICAL 9.9

See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences