Critical · published June 1, 2023
🚨 Sneaky privilege mismanagement allows standard users to wield powers they shouldn't have! 🔥 Think of it as a restaurant where a regular diner can access the chef's private recipes. They can delete entries from the menu, but still have a read-only view of the hidden treasures, allowing them to potentially recreate secret dishes without permission. An attacker could delete Kubernetes secrets while keeping their permissions intact, leading to unauthorized access to service account tokens. Imagine a regular customer now having the ability to access the chef's secret stash—this could compromise the entire kitchen's operation, leaving sensitive data exposed!
Think of it as a restaurant where a regular diner can access the chef's private recipes. They can delete entries from the menu, but still have a read-only view of the hidden treasures, allowing them to potentially recreate secret dishes without permission. The improper privilege management vulnerability in SUSE Rancher lets users misuse their permissions to manipulate Kubernetes secrets, leading to potential unauthorized access to sensitive tokens in the local cluster.
An attacker could delete Kubernetes secrets while keeping their permissions intact, leading to unauthorized access to service account tokens. Imagine a regular customer now having the ability to access the chef's secret stash—this could compromise the entire kitchen's operation, leaving sensitive data exposed! Upgrade Rancher to versions >= 2.6.13 or >= 2.7.4 immediately to patch this issue. Conduct a review of user permissions to ensure that access controls are properly enforced. Don't forget to audit your Kubernetes secrets for any unauthorized changes! You've got this! Patch now, and you'll have your cluster secured in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| suse/rancher | ≥ 2.7.0, < 2.7.4 | 2.7.4 |
| suse/rancher | ≥ 2.6.0, < 2.6.13 | 2.6.13 |