CVE-2024-22032CWE-200

Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec

High · published October 16, 2024

CVSS v4.0
7.1
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

A vulnerability has been identified in which an RKE1 cluster keeps

constantly reconciling when secrets encryption configuration is enabled.

When reconciling, the Kube API secret values are written in plaintext

on the AppliedSpec. Cluster owners, Cluster members, and Project members

(for projects within the cluster), all have RBAC permissions to view

the cluster object from the apiserver.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00377 · 30.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2024-10-16T13:26Z
EPSS history
Timeline
  • 16 OCT 13:26Z
    Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec
    cvelistv5