Most recent entries from all

bdu:2023-00909

2026-10-03T09:40:57.640323+00:00

bdu:2023-00909

EUVD-2026-224916

2026-10-03T09:40:57.640354+00:00

EUVD-2026-224916

fkie_cve-2022-43757

2026-10-03T09:40:57.640369+00:00

A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

GHSA-cq4p-vp5q-4522 — Plaintext storage of sensitive data in Rancher API and cluster.management.cattle.io objects

2026-10-03T09:40:57.640397+00:00

Affected: Go: github.com/rancher/rancher

### Impact

This issue affects Rancher versions from 2.5.0 up to and including 2.5.16, from 2.6.0 up to and including 2.6.9 and 2.7.0. It was discovered that the security advisory CVE-2021-36782 (GHSA-g7j7-h4q8-8w2f), previously released by Rancher, missed addressing some sensitive fields, secret tokens, encryption keys, and SSH keys that were still being stored in plaintext directly on Kubernetes objects like `Clusters`.

The exposed credentials are visible in Rancher to authenticated `Cluster Owners`, `Cluster Members`, `Project Owners` and `Project Members` of that cluster on the endpoints:

- `/v1/management.cattle.io.cluster` - `/v1/management.cattle.io.clustertemplaterevisions`

The remaining sensitive fields are now stripped from `Clusters` and other objects and moved to a `Secret` before the object is stored. The `Secret` is retrieved when the credential is needed. For objects that existed before this security fix, a one-time migration happens on startup.

The fields that have been addressed by this security fix are:

- `Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].AESGCM.Keys[].Secret` - `Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].AESCBC.Keys[].Secret` - `Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].SecretboxConfiguration.Keys[].Secret` - `Cluster.Spec.RancherKubernetesEngine…

gsd-2022-43757

2026-10-03T09:40:57.640446+00:00

gsd-2022-43757

WID-SEC-W-2023-0197 — Rancher: Mehrere Schwachstellen

2026-10-03T09:40:57.640459+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, seine Rechte zu erweitern und Code auszuführen.