Description
A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET
access to the Rancher Manager Apps Catalog to read any sensitive information that are
contained within the Apps’ values. Additionally, the same information
leaks into auditing logs when the audit level is set to equal or above
2.
This issue affects rancher: from 2.8.0 before 2.8.10, from 2.9.0 before 2.9.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | rancher | 2.8.0 – < 2.8.10, 2.9.0 – < 2.9.4 | 2.8.10 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241121T195252-1.1 | openSUSE-SU-2024:14519-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/rancher/rancher | >= 2.8.0, < 2.8.10 | 2.8.10 | GHSA-9c5p-35gj-jqp4 |
| Go | github.com/rancher/rancher | >= 2.9.0, < 2.9.4 | 2.9.4 | GHSA-9c5p-35gj-jqp4 |
| Go | github.com/rancher/rancher | all versions | — | GO-2024-3280 |
Advisories 2
- openSUSE-SU-2024:14519-1 govulncheck-vulndb-0.0.20241121T195252-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-3504 Rancher: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Nov 19, 2024