Medium severity6.5NVD Advisory· Published Oct 16, 2024· Updated Apr 15, 2026

CVE-2024-22032

Description

A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling, the Kube API secret values are written in plaintext on the AppliedSpec. Cluster owners, Cluster members, and Project members (for projects within the cluster), all have RBAC permissions to view the cluster object from the apiserver.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/rancher/rancherGo	>= 2.7.0, < 2.7.14	2.7.14
github.com/rancher/rancherGo	>= 2.8.0, < 2.8.5	2.8.5

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-q6c7-56cq-g2wmghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-22032ghsaADVISORY
bugzilla.suse.com/show_bug.cginvdWEB
github.com/rancher/rancher/security/advisories/GHSA-q6c7-56cq-g2wmnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000