VULNERABILITY INTELLIGENCE

CVE-2019-12274

CVSS score8.8 HIGH
EPSS probability1.12%
CISA KEVNot currently listed
Published2019-06-06
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.

Weakness classification

  • CWE-668: Exposure of Resource to Wrong Sphere
  • CWE-862: Missing Authorization

Primary references