High severity · published Jun 1, 2023
CVE-2023-22647
An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local …
8.0
CVSS
0.7%
EPSS
No
On KEV
Description
An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local
cluster, resulting in the secret being deleted, but their read-level
permissions to the secret being preserved. When this operation was
followed-up by other specially crafted commands, it could result in the
user gaining access to tokens belonging to service accounts in the local cluster.
This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rancher · Suse
2.6.0 before 2.6.13; 2.7.0 before 2.7.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-22647
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-22647
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22647
Vendor Advisory
https://github.com/rancher/rancher/security/advisories/GHSA-p976-h52c-26p6
More from Rancher
9.9
CVE-2026-44935
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
9.9
CVE-2026-41050
Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
9.9
CVE-2023-22651
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation
9.9
CVE-2021-36783
A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials,…
9.9
CVE-2021-36782
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to…