https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:37:38 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-04694 bdu:2024-04694 https://cve.radiocsirt.org/vuln/bdu:2024-04694 https://cve.radiocsirt.org/vuln/euvd-2026-195998 EUVD-2026-195998 https://cve.radiocsirt.org/vuln/euvd-2026-195998 https://cve.radiocsirt.org/vuln/fkie_cve-2023-32191 <p>When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin.</p> <p>When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-32191 https://cve.radiocsirt.org/vuln/ghsa-6gr4-52w6-vmqx <p><strong>Affected:</strong> Go: github.com/rancher/rke</p> <p>### Impact</p> <p>When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include the following sensitive data:</p> <p>- RancherKubernetesEngineConfig - RKENodeConfig - SSH username - SSH private key - SSH private key path - RKEConfigServices - ETCDService - External client key - BackupConfig - S3BackupConfig - AWS access key - AWS secret key - KubeAPIService - SecretsEncryptionConfig - K8s encryption configuration (contains encryption keys) - PrivateRegistries - User - Password - ECRCredentialPlugin - AWS access key - AWS secret key - AWS session token - CloudProvider - AzureCloudProvider - AAD client ID - AAD client secret - AAD client cert password - OpenstackCloudProvider - Username - User ID - Password - VsphereCloudProvider - GlobalVsphereOpts - User - Password - VirtualCenterConfig - User - Password - HarvesterCloudProvider - CloudConfig - CustomCloudProvider - BastionHost - User - SSH…</p> <p><strong>Affected:</strong> Go: github.com/rancher/rke</p> <p>### Impact</p> <p>When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include the following sensitive data:</p> <p>- RancherKubernetesEngineConfig - RKENodeConfig - SSH username - SSH private key - SSH private key path - RKEConfigServices - ETCDService - External client key - BackupConfig - S3BackupConfig - AWS access key - AWS secret key - KubeAPIService - SecretsEncryptionConfig - K8s encryption configuration (contains encryption keys) - PrivateRegistries - User - Password - ECRCredentialPlugin - AWS access key - AWS secret key - AWS session token - CloudProvider - AzureCloudProvider - AAD client ID - AAD client secret - AAD client cert password - OpenstackCloudProvider - Username - User ID - Password - VsphereCloudProvider - GlobalVsphereOpts - User - Password - VirtualCenterConfig - User - Password - HarvesterCloudProvider - CloudConfig - CustomCloudProvider - BastionHost - User - SSH…</p> https://cve.radiocsirt.org/vuln/ghsa-6gr4-52w6-vmqx https://cve.radiocsirt.org/vuln/gsd-2023-32191 gsd-2023-32191 https://cve.radiocsirt.org/vuln/gsd-2023-32191 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1397 <p>Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Dateien zu manipulieren, seine Privilegien zu erweitern oder vertrauliche Informationen offenzulegen.</p> <p>Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Dateien zu manipulieren, seine Privilegien zu erweitern oder vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1397