Read the docs
TI-2023-08825 Aliases CVE-2023-22649GHSA-xfj7-qf8w-2gcr

Rancher 'Audit Log' leaks sensitive information

Priority MEDIUM 42CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only deployments that have it enabled and have [AUDIT_LEVEL](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels) set to `1 or above` are impacted by this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02039 81st percentileScored 2026-11-07
Fix Fixed rancher (SUSE): 2.6.14, 2.7.10, 2.8.2github.com/rancher/rancher (Go): 2.6.14, 2.7.10, 2.8.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSErancher2.6.0 to before 2.6.14; 2.7.0 to before 2.7.10; 2.8.0 to before 2.8.22.6.14, 2.7.10, 2.8.2Patch availableCNA
—github.com/rancher/rancher (Go)2.6.0 to before 2.6.142.6.14Patch availableGHSA-xfj7-qf8w-2gcr
—github.com/rancher/rancher (Go)2.7.0 to before 2.7.102.7.10Patch availableGHSA-xfj7-qf8w-2gcr
—github.com/rancher/rancher (Go)2.8.0 to before 2.8.22.8.2Patch availableGHSA-xfj7-qf8w-2gcr
  • rancher VendorSUSE Affected 2.6.0 to before 2.6.14; 2.7.0 to before 2.7.10; 2.8.0 to before 2.8.2 Fixed in 2.6.14, 2.7.10, 2.8.2 Patch available CNA
  • github.com/rancher/rancher (Go) Vendor— Affected 2.6.0 to before 2.6.14 Fixed in 2.6.14 Patch available GHSA-xfj7-qf8w-2gcr
  • github.com/rancher/rancher (Go) Vendor— Affected 2.7.0 to before 2.7.10 Fixed in 2.7.10 Patch available GHSA-xfj7-qf8w-2gcr
  • github.com/rancher/rancher (Go) Vendor— Affected 2.8.0 to before 2.8.2 Fixed in 2.8.2 Patch available GHSA-xfj7-qf8w-2gcr

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:undefined2.6.0 to before 2.6.14VulnerableSUSE
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*2.7.0 to before 2.7.10; 2.8.0 to before 2.8.2VulnerableSUSE
  • cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:undefined Versions 2.6.0 to before 2.6.14 Vulnerable ·SUSE
  • cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* Versions 2.7.0 to before 2.7.10; 2.8.0 to before 2.8.2 Vulnerable ·SUSE

Remediation

  • Fix · CNA rancher (SUSE) Fixed in 2.6.14, 2.7.10, 2.8.2
  • Fix · GHSA-xfj7-qf8w-2gcr github.com/rancher/rancher (Go) Fixed in 2.6.14 Advisory →
  • Fix · GHSA-xfj7-qf8w-2gcr github.com/rancher/rancher (Go) Fixed in 2.7.10 Advisory →
  • Fix · GHSA-xfj7-qf8w-2gcr github.com/rancher/rancher (Go) Fixed in 2.8.2 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SUSE rancher 2.6.14, 2.7.10, 2.8.2

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2023-15495 Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'Priority MEDIUM 40
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22649
  2. 2026-10-03 Alias added: GHSA-xfj7-qf8w-2gcr

References

Advisory 2

Other 2

  • TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
  • TI-2022-21489 Rancher: Non-random authentication token CVSS 3.1CRITICAL 9.8
  • TI-2019-08380 An issue was discovered that affects the following versions of Rancher: v2.0.0 through… CVSS 3.0CRITICAL 9.8
  • TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
  • TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
  • TI-2022-21491 Rancher: Exposure of sensitive fields CVSS 3.1CRITICAL 9.9
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences