UpHeron
All vulnerabilities

Servers and applications

CVE-2022-21951

Weave CNI password is not configured when a cluster is created from an RKE template

Severity
Medium 6.8
Published
24 May 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.5.14, 2.6.5
Also known as
GHSA-vrph-m5jj-c46c
Sources
NVD, Project advisories (GitHub)

Description

A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption of data transmitted via the network when a cluster is created from an RKE template with the CNI value overridden This issue affects: SUSE Rancher Rancher versions prior to 2.5.14; Rancher versions prior to 2.6.5.

Affected software

SoftwareAffected versions
RancherServers and applications · cpe:a:suse:rancher
  • From 2.5.0 before 2.5.14
  • From 2.6.0 before 2.6.5
RancherServers and applications · github:rancher/rancher
  • From 2.5.0 before 2.5.14
  • From 2.6.0 before 2.6.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-21951
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-21951
  • GitHub Advisory Database https://github.com/advisories/GHSA-vrph-m5jj-c46c
  • github.com https://github.com/rancher/rancher/security/advisories/GHSA-vrph-m5jj-c46c