CVE-2023-22650: Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider
Vulnerability summary
CVE-2023-22650 is a high (CVSS 8.8) Improper Authentication vulnerability in suse rancher. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 16-10-2024PublishedVulnerability first disclosed.
- 16-10-2024Last modifiedVulnerability information updated.
Description
A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.
CVSS metrics
7 scores · 4 sources · 2 versions- OSV · GoEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · GoEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.61% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Chainguard4 products
- harvester< 1.8.1-r1
- harvester-fips< 1.8.1-r0
- harvester-fips-webhook< 1.8.1-r0
- harvester-webhook< 1.8.1-r1
Github.com/rancher1 product
- rancher≥ 2.7.0, < 2.7.14 | ≥ 2.8.0, < 2.8.5 | All versions (No fix recorded)
Suse1 product
- rancher≥ 2.7.0, < 2.7.14 | ≥ 2.8.0, < 2.8.5
3 vendors · 6 products
References
5 links
- github.com/rancher/rancherPACKAGE