Vulnerabilities

TI-2024-14652 CVE-2024-22032 · GHSA-q6c7-56cq-g2wm

Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec

LOW 31

A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00377 Published 2024-10-16 Fixed in 2.7.14, 2.8.5 CWE-200

TI-2023-15496 CVE-2023-32196 · GHSA-64jq-m7rq-768h

Rancher's External RoleTemplates can lead to privilege escalation

LOW 36

A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific scenarios can lead to privilege escalation.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00553 Published 2024-10-16 Fixed in 2.7.14, 2.8.5 CWE-269

TI-2023-08826 CVE-2023-22650 · GHSA-9ghh-mmcq-8phc

Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider

MEDIUM 41

A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP).

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00607 Published 2024-10-16 Fixed in 2.7.14, 2.8.5 CWE-287

Vulnerabilities

Filters

Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec

Rancher's External RoleTemplates can lead to privilege escalation

Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider