cve.bz

CVE-2024-52284

7.7 highEPSS 0.2%

Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.

Severity

CVSS 3.1

7.7 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWE
CWE-312
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-6h9x-9j5v-7w9hGogithub.com/rancher/fleet>=0.13.0 <0.13.1-0.20250806151509-088bcbea7edb0.13.1-0.20250806151509-088bcbea7edb
GHSA-6h9x-9j5v-7w9hGogithub.com/rancher/fleet>=0.12.0 <0.12.60.12.6
GHSA-6h9x-9j5v-7w9hGogithub.com/rancher/fleet>=0.11.0 <0.11.100.11.10
GO-2025-3927Gogithub.com/rancher/fleet>=0.11.0 <0.11.10
>=0.12.0 <0.12.6
>=0.13.0 <0.13.1-0.20250806151509-088bcbea7edb		0.11.10, 0.12.6, 0.13.1-0.20250806151509-088bcbea7edb

References

Check your stackJSON