UpHeron
All vulnerabilities

Servers and applications

CVE-2019-12274

In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.

Severity
High 8.8
Published
6 Jun 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
1.1% in the next 30 daysHigher than 66% of CVEs. EPSS by FIRST, 10 Nov 2026
Weakness
Exposure of a resource to the wrong sphere (CWE-668)Missing authorization (CWE-862)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Sources
NVD

Affected software

SoftwareAffected versions
RancherServers and applications · cpe:a:suse:rancher
  • From 1.0.0 up to 1.6.28
  • From 2.0.0 up to 2.2.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-12274
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-12274