Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object
Vulnerability Description
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-36782
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Florian Struck (from Continum AG) and Marco Stuurman (from Shock Media B.V.)
References
More from SUSE
View All →Affected Vendor
SUSE
View all reports →