{"id":"GHSA-mw39-9qc2-f7mg","revision":null,"records":[{"revision":"dd92662915844b28b66553aa1c7a8232","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-58269","aliases":[],"title":"Rancher exposes sensitive information through audit logs","description":"A vulnerability has been identified in Rancher Manager, where sensitive \ninformation, including secret data, cluster import URLs, and \nregistration tokens, is exposed to any entity with access to Rancher \naudit logs.","state":0,"publishedAt":"2025-10-29T14:58:06.64+00:00","modifiedAt":"2025-10-29T15:10:05.138+00:00","affected":[{"ecosystem":"Vendor product","name":"github.com/rancher/rancher","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"github.com/rancher/rancher\",\n                    \"product\": \"rancher\",\n                    \"vendor\": \"SUSE\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"0.0.0-20251013203444-50dc516a19ea\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-58269","https://github.com/rancher/rancher/security/advisories/GHSA-mw39-9qc2-f7mg"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-58269","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-58269","identifiers":["CVE-2024-58269"]},"retained":false,"historicalAffected":[]},{"revision":"0345f60e10034fe4a543103e33cc0d52","observedAt":"2026-11-11T01:39:20.368+00:00","statement":{"source":"euvd","id":"EUVD-2025-35858","aliases":["CVE-2024-58269","GHSA-mw39-9qc2-f7mg"],"title":"A vulnerability has been identified in Rancher Manager, where sensitive ","description":"A vulnerability has been identified in Rancher Manager, where sensitive \ninformation, including secret data, cluster import URLs, and \nregistration tokens, is exposed to any entity with access to Rancher \naudit logs.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":null}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-58269","https://github.com/rancher/rancher/security/advisories/GHSA-mw39-9qc2-f7mg"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-35858","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 29, 2025, 2:58:06 PM","dateUpdated":"Oct 29, 2025, 3:10:05 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2025-2395","title":"Rancher Manager: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2023-32199","CVE-2024-58269"]},{"id":"openSUSE-SU-2025:15710-1","title":"govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media","vulnerabilityIds":["CVE-2016-11063","CVE-2016-11066","CVE-2016-11067","CVE-2016-11068","CVE-2016-11069","CVE-2016-11070","CVE-2016-11071","CVE-2016-11072","CVE-2016-11073","CVE-2016-11074","CVE-2016-11075","CVE-2016-11076","CVE-2016-11077","CVE-2016-11078","CVE-2016-11079","CVE-2016-11080","CVE-2016-11081","CVE-2016-11082","CVE-2016-11083","CVE-2016-11084","CVE-2017-18872","CVE-2023-32199","CVE-2024-58269","CVE-2025-10545","CVE-2025-10678","CVE-2025-10954","CVE-2025-11374","CVE-2025-11375","CVE-2025-11579","CVE-2025-11621","CVE-2025-12044","CVE-2025-26625","CVE-2025-27093","CVE-2025-41410","CVE-2025-41443","CVE-2025-54286","CVE-2025-54287","CVE-2025-54288","CVE-2025-54289","CVE-2025-54290","CVE-2025-54291","CVE-2025-54293","CVE-2025-54469","CVE-2025-54470","CVE-2025-54471","CVE-2025-54499","CVE-2025-58073","CVE-2025-58075","CVE-2025-58356","CVE-2025-59043","CVE-2025-59048","CVE-2025-59530","CVE-2025-59836","CVE-2025-59937","CVE-2025-61141","CVE-2025-61524","CVE-2025-61581","CVE-2025-61688","CVE-2025-62156","CVE-2025-62157","CVE-2025-62375","CVE-2025-62506","CVE-2025-62513","CVE-2025-62705","CVE-2025-62714","CVE-2025-62725","CVE-2025-62820","CVE-2025-64101","CVE-2025-64102","CVE-2025-64103"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-35858","identifiers":["EUVD-2025-35858","CVE-2024-58269","GHSA-mw39-9qc2-f7mg"]},"retained":false,"historicalAffected":[]},{"revision":"e1a74477d4e84e50a0085934485d80f0","observedAt":"2026-10-25T01:17:17.137+00:00","statement":{"source":"nvd","id":"CVE-2024-58269","aliases":[],"title":"A vulnerability has been identified in Rancher Manager, where sensitive ","description":"A vulnerability has been identified in Rancher Manager, where sensitive \ninformation, including secret data, cluster import URLs, and \nregistration tokens, is exposed to any entity with access to Rancher \naudit logs.","state":0,"publishedAt":"2025-10-29T15:15:41.077+00:00","modifiedAt":"2026-10-02T00:10:00.18+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · meissner@suse.de · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-58269","https://github.com/rancher/rancher/security/advisories/GHSA-mw39-9qc2-f7mg"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-58269","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-532"],"productCriteria":[],"sourceDates":{"published":"2025-10-29T15:15:41.077","lastModified":"2026-10-02T00:10:00.180"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2024-58269","identifiers":["CVE-2024-58269"]},"retained":false,"historicalAffected":[]},{"revision":"9fe405b45d4b4e03905cd9f80fd2368f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-mw39-9qc2-f7mg","aliases":["CVE-2024-58269","GO-2025-4074"],"title":"Rancher exposes sensitive information through audit logs","description":"### Impact\n**Note: The exploitation of this issue requires that the malicious user have access to Rancher’s audit log storage.**\n\nA vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs. This happens in two different ways:\n\n1. Secret Annotation Leakage: When creating Kubernetes Secrets using the `stringData` field, the cleartext value is embedded in the `kubectl.kubernetes.io/last-applied-configuration` annotation. This annotation is included in Rancher audit logs within both the request and response bodies, exposing secret material that should be redacted.\n2. Cluster Registration Token Leakage: During the import or creation of downstream clusters (Custom, Imported, or Harvester), Rancher audit logs record full cluster registration manifests and tokens, including:\na. Non-expiring import URLs such as `/v3/import/<token>_c-m-xxxx.yaml`.\nb. Full `kubectl apply` and `curl` commands containing registration tokens and CA checksums.\nc. Token values associated with cluster registration resources (`clusterRegistrationToken`).\nd. These tokens are valid until explicitly revoked and can be used to re-register nodes, granting unauthorized cluster access.\n\nAn attacker or internal user who gains access to these logs could:\n- Recover plaintext secret values from annotations.\n- Use cluster registration tokens or import URLs to re-enroll agents or compromise downstream clusters.\n- Access clusters that rely on these tokens for authentication, enabling lateral movement.\n\nPlease consult the associated  [MITRE ATT&CK - Technique - Log Enumeration](https://attack.mitre.org/techniques/T1654/) for further information about this category of attack.\n\n### Patches\nThis vulnerability is addressed by applying redaction to sensitive information that was leaking.\n\nPatched versions of Rancher include release `v2.12.3`.\n\n### Workarounds\nIf the deployment can't be upgraded to a fixed version, users are encouraged to create `AuditPolicies` to redact and filter some of those requests as described in our [documentation](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-policies).\n\nThe following AuditPolicy can be applied to redact the secrets:\n```yaml\napiVersion: auditlog.cattle.io/v1\nkind: AuditPolicy\nmetadata:\n  name: redactions\nspec:\n  enabled: true\n  additionalRedactions:\n    - headers:\n      - \"Referer\"\n    - paths:\n      - \"$..metadata.annotations['kubectl.kubernetes.io/last-applied-configuration']\"\n```\n\nAlso consider granting access to Rancher's logs only for trusted users.\n\n\n### References\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).","state":0,"publishedAt":"2025-10-24T15:27:13+00:00","modifiedAt":"2025-11-05T19:57:14.95914+00:00","affected":[{"ecosystem":"Go","name":"github.com/rancher/rancher","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20251013203444-50dc516a19ea"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/rancher/rancher/security/advisories/GHSA-mw39-9qc2-f7mg","https://nvd.nist.gov/vuln/detail/CVE-2024-58269","https://github.com/rancher/rancher/commit/26ad9216e94f77b5471f638256a6989030572adc","https://github.com/rancher/rancher/commit/50dc516a19ea216e270f738912dc8d0c9ca99d5d","https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-58269","https://github.com/rancher/rancher"],"sourceUrl":"https://github.com/advisories/GHSA-mw39-9qc2-f7mg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mw39-9qc2-f7mg","identifiers":["GHSA-mw39-9qc2-f7mg","CVE-2024-58269","GO-2025-4074"]},"retained":false,"historicalAffected":[]},{"revision":"23f38c20038e47618cb1a6e275d0093b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-4074","aliases":["CVE-2024-58269","GHSA-mw39-9qc2-f7mg"],"title":"Rancher exposes sensitive information through audit logs in github.com/rancher/rancher","description":"Rancher exposes sensitive information through audit logs in github.com/rancher/rancher","state":0,"publishedAt":"2025-10-30T15:02:33+00:00","modifiedAt":"2026-03-03T04:57:05.023015+00:00","affected":[{"ecosystem":"Go","name":"github.com/rancher/rancher","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20251013203444-50dc516a19ea"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/rancher/rancher/security/advisories/GHSA-mw39-9qc2-f7mg","https://github.com/rancher/rancher/commit/26ad9216e94f77b5471f638256a6989030572adc","https://github.com/rancher/rancher/commit/50dc516a19ea216e270f738912dc8d0c9ca99d5d"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-4074","license":"OSV · upstream source license applies","key":"osv:GO-2025-4074","identifiers":["GO-2025-4074","CVE-2024-58269","GHSA-mw39-9qc2-f7mg"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T20:58:42.4460032+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T20:58:42.4460032+00:00","lastSuccessAt":"2026-11-11T20:58:42.6009016+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.6009024+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-bc2564cf749a574ebe6216cd53b2772c98ccf01e107d9e465c7cb9637c59db40","complete":true,"records":424281,"lastAttemptAt":"2026-11-11T20:56:40.1262638+00:00","lastSuccessAt":"2026-11-11T19:56:47.8167322+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:56:40.1262638+00:00","snapshotPublishedAt":"2026-11-11T19:18:45+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cbeeeca22e4a4c188e95cc4f8cfc6560","complete":false,"records":13759,"lastAttemptAt":"2026-11-11T21:08:58.0161049+00:00","lastSuccessAt":"2026-11-11T21:08:58.011+00:00","error":"249 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-11T21:08:58.011+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13368,"expectedIdentifiers":13813,"failedIdentifiers":249},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T20:58:42.4460032+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T20:58:42.4460032+00:00","lastSuccessAt":"2026-11-11T20:58:42.6018487+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.6018491+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f58072f00ed84b8dbc554f4a4e66e21a","complete":true,"records":13753,"lastAttemptAt":"2026-11-11T20:59:01.4643428+00:00","lastSuccessAt":"2026-11-11T20:59:01.459+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:59:01.459+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T20:58:42.3041045+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.3041045+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T20:56:40.2809572+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:56:40.2809572+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T20:58:42.411286+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.411286+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-757d3692f9a7b34792dad960197f3cc953a54db59b7d0ffe3835a0ed9926f76b","complete":true,"records":231690,"lastAttemptAt":"2026-11-11T20:58:42.1683586+00:00","lastSuccessAt":"2026-11-11T20:58:40.6131056+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.1683586+00:00","snapshotPublishedAt":"2026-11-11T20:03:03+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}