CVE-2019-12274

In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver…

published June 6, 2019

CVSS
—
EPSS
1%
Percentile
65.9
In the wild
Unconfirmed
What it is

In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01122 · 65.9th percentile
Published
2019-06-06T15:07Z
EPSS history
Timeline
  • 06 JUN 15:07Z
    In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver…
    cvelistv5