CVE-2019-12274: suse rancher Exposure of Resource to Wrong Sphere
Vulnerability summary
CVE-2019-12274 is a high (CVSS 8.8) Exposure of Resource to Wrong Sphere vulnerability in suse rancher. EPSS estimates a 1.12% chance of exploitation in the next 30 days, higher than 65.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 06-06-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · GoEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.12%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
+0.09 pp
From 1.03% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Chainguard4 products
- harvesterAll versions (No fix recorded)
- harvester-fipsAll versions (No fix recorded)
- harvester-fips-webhookAll versions (No fix recorded)
- harvester-webhookAll versions (No fix recorded)
Github.com/rancher1 product
- rancher≥ 2.0.0, < 2.2.4 | < 1.6.27 | ≥ 2.0.0+incompatible, < 2.2.4+incompatible
Suse1 product
- rancher≥ 1.0.0, ≤ 1.6.28 | ≥ 2.0.0, ≤ 2.2.3
3 vendors · 6 products
