https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:40:24 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-00909 bdu:2023-00909 https://cve.radiocsirt.org/vuln/bdu:2023-00909 https://cve.radiocsirt.org/vuln/euvd-2026-224916 EUVD-2026-224916 https://cve.radiocsirt.org/vuln/euvd-2026-224916 https://cve.radiocsirt.org/vuln/fkie_cve-2022-43757 <p>A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.</p> <p>A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-43757 https://cve.radiocsirt.org/vuln/ghsa-cq4p-vp5q-4522 <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact</p> <p>This issue affects Rancher versions from 2.5.0 up to and including 2.5.16, from 2.6.0 up to and including 2.6.9 and 2.7.0. It was discovered that the security advisory CVE-2021-36782 (GHSA-g7j7-h4q8-8w2f), previously released by Rancher, missed addressing some sensitive fields, secret tokens, encryption keys, and SSH keys that were still being stored in plaintext directly on Kubernetes objects like `Clusters`.</p> <p>The exposed credentials are visible in Rancher to authenticated `Cluster Owners`, `Cluster Members`, `Project Owners` and `Project Members` of that cluster on the endpoints:</p> <p>- `/v1/management.cattle.io.cluster` - `/v1/management.cattle.io.clustertemplaterevisions`</p> <p>The remaining sensitive fields are now stripped from `Clusters` and other objects and moved to a `Secret` before the object is stored. The `Secret` is retrieved when the credential is needed. For objects that existed before this security fix, a one-time migration happens on startup.</p> <p>The fields that have been addressed by this security fix are:</p> <p>- `Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].AESGCM.Keys[].Secret` - `Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].AESCBC.Keys[].Secret` - `Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].SecretboxConfiguration.Keys[].Secret` - `Cluster.Spec.RancherKubernetesEngine…</p> <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact</p> <p>This issue affects Rancher versions from 2.5.0 up to and including 2.5.16, from 2.6.0 up to and including 2.6.9 and 2.7.0. It was discovered that the security advisory CVE-2021-36782 (GHSA-g7j7-h4q8-8w2f), previously released by Rancher, missed addressing some sensitive fields, secret tokens, encryption keys, and SSH keys that were still being stored in plaintext directly on Kubernetes objects like `Clusters`.</p> <p>The exposed credentials are visible in Rancher to authenticated `Cluster Owners`, `Cluster Members`, `Project Owners` and `Project Members` of that cluster on the endpoints:</p> <p>- `/v1/management.cattle.io.cluster` - `/v1/management.cattle.io.clustertemplaterevisions`</p> <p>The remaining sensitive fields are now stripped from `Clusters` and other objects and moved to a `Secret` before the object is stored. The `Secret` is retrieved when the credential is needed. For objects that existed before this security fix, a one-time migration happens on startup.</p> <p>The fields that have been addressed by this security fix are:</p> <p>- `Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].AESGCM.Keys[].Secret` - `Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].AESCBC.Keys[].Secret` - `Cluster.Spec.RancherKubernetesEngineConfig.Services.KubeAPI.SecretsEncryptionConfig.CustomConfig.Providers[].SecretboxConfiguration.Keys[].Secret` - `Cluster.Spec.RancherKubernetesEngine…</p> https://cve.radiocsirt.org/vuln/ghsa-cq4p-vp5q-4522 https://cve.radiocsirt.org/vuln/gsd-2022-43757 gsd-2022-43757 https://cve.radiocsirt.org/vuln/gsd-2022-43757 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0197 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, seine Rechte zu erweitern und Code auszuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, seine Rechte zu erweitern und Code auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0197