PT-2024-10046 · Rancher+2 · Rke2+3

Published 2024-06-17 · Updated 2025-04-16 · CVE-2023-32197

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rancher Manager versions prior to v2.8.9 RKE2 versions prior to v1.27.15 RKE2 versions prior to v1.28.11 RKE2 versions prior to v1.29.6 RKE2 versions prior to v1.30.2

Description The issue is related to incorrect permission assignment for a critical resource in the Rancher Manager tool for managing Kubernetes clusters. This can allow a remote attacker to escalate their privileges due to insecure Access Control Lists. The vulnerability affects Windows nodes.

Recommendations For RKE2 versions prior to v1.27.15, update to version v1.27.15 or later. For RKE2 versions prior to v1.28.11, update to version v1.28.11 or later. For RKE2 versions prior to v1.29.6, update to version v1.29.6 or later. For RKE2 versions prior to v1.30.2, update to version v1.30.2 or later. For Rancher Manager versions prior to v2.8.9, update to version v2.8.9 or later. As a temporary workaround, consider restricting access to the vulnerable github.com/rancher/rke2 and github.com/rancher/rancher modules until a patch is available.

Exploit

Fix

LPE

Incorrect Permission

Improper Privilege Management

Weakness Enumeration

CWE-732

CWE-269

Related Identifiers

BDU:2025-00184

CVE-2023-32197

GHSA-64JQ-M7RQ-768H

GHSA-7H8M-PVW3-5GH4

GHSA-X7XJ-JVWP-97RV

GO-2024-2929

GO-2024-3220

GO-2024-3222

OPENSUSE-SU-2024:0350-1

OPENSUSE-SU-2024:14447-1

OPENSUSE-SU-2024_3911-1

SUSE-SU-2024:3911-1

Affected Products

Rke2

Rancher Manager

Suse

Windows

References · 85

• 🔥 https://advisories.gitlab.com/pkg/golang/github.com/rancher/rancher/CVE-2023-32197 · Exploit
• https://osv.dev/vulnerability/GHSA-64jq-m7rq-768h · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3220 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3222 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0350-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x7xj-jvwp-97rv · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14447-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32196 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32197 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2929 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32197 · Security Note
• https://bdu.fstec.ru/vul/2025-00184 · Security Note
• https://osv.dev/vulnerability/GHSA-7h8m-pvw3-5gh4 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3911-1 · Vendor Advisory
• https://github.com/rancher/rancher · Note