cve.bz

CVE-2019-12274

8.8 highEPSS 1.1%

High (8.8) in suse rancher. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in github.com/rancher/rancher 1.6.27, 2.2.4, 2.2.4+incompatible.

In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.

Severity

CVSS 3.0

8.8 high
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWEs
CWE-668, CWE-862
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-gc62-j469-9gjmGogithub.com/rancher/rancher>=2.0.0 <2.2.42.2.4
GHSA-gc62-j469-9gjmGogithub.com/rancher/rancher<1.6.271.6.27
GO-2023-1991Gogithub.com/rancher/rancher<1.6.27
>=2.0.0+incompatible <2.2.4+incompatible		1.6.27, 2.2.4+incompatible

References

Check your stackJSON