CVE-2021-36782criticalCWE-312

CVE-2021-36782: critical vulnerability in SUSE Rancher

Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object

Published · Updated

63Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.9epss 4.2%
from disclosure to weapon85 days
Published on NVDSep 7
1st PoC+85d
metasploitAug 18
exploitation probability
4.2%top 9% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
In short

Rancher stores sensitive credentials in plain text where authenticated users can read them through the Kubernetes API. This means anyone with basic access to a Rancher cluster can retrieve passwords and secrets that should be protected.

Technical detail

CWE-312 vulnerability allows authenticated users (Cluster Owners, Members, Project Owners, Members, and base users) to retrieve plaintext sensitive data via Kubernetes API calls in Rancher versions before 2.5.16 and 2.6.7. Pre-conditions require valid authentication; impact includes exposure of all stored credentials and secrets.

Summary generated and translated by AI from the official description.
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
SUSE · Rancher
public PoCs found — 1
githubgithub.com/fe-ax/tf-cve-2021-36782★ 0
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SUSE Rancher

In the same product, most dangerous first.

CVE-2022-31249HIGH[RANCHER] OS command injection in Rancher and FleetEPSS 3.8%CVE-2022-43755HIGHRancher: Non-random authentication tokenEPSS 1.7%CVE-2021-25313HIGHRancher: XSS on /v3/cluster/EPSS 1.5%CVE-2026-44939CRITICALCommand injection through unsanitized YAML parameter in RancherEPSS 1.3%CVE-2021-36776HIGHSteve API proxy impersonationEPSS 1.1%CVE-2022-43758HIGHRancher: Command injection in Git packageEPSS 1.0%
References
https://bugzilla.suse.com/show_bug.cgi?id=1193988https://github.com/rancher/rancher/security/advisories/GHSA-g7j7-h4q8-8w2f