CVE-2024-58269

Rancher exposes sensitive information through audit logs

apiVersion: auditlog.cattle.io/v1
kind: AuditPolicy
metadata:
  name: redactions
spec:
  enabled: true
  additionalRedactions:
    - headers:
      - "Referer"
    - paths:
      - "$..metadata.annotations['kubectl.kubernetes.io/last-applied-configuration']"

Note: The exploitation of this issue requires that the malicious user have access to Rancher’s audit log storage.

A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs. This happens in two different ways:

1. Secret Annotation Leakage: When creating Kubernetes Secrets using the stringData field, the cleartext value is embedded in the kubectl.kubernetes.io/last-applied-configuration annotation. This annotation is included in Rancher audit logs within both the request and response bodies, exposing secret material that should be redacted.
2. Cluster Registration Token Leakage: During the import or creation of downstream clusters (Custom, Imported, or Harvester), Rancher audit logs record full cluster registration manifests and tokens, including:
   a. Non-expiring import URLs such as /v3/import/<token>_c-m-xxxx.yaml.
   b. Full kubectl apply and curl commands containing registration tokens and CA checksums.
   c. Token values associated with cluster registration resources (clusterRegistrationToken).
   d. These tokens are valid until explicitly revoked and can be used to re-register nodes, granting unauthorized cluster access.

An attacker or internal user who gains access to these logs could:

• Recover plaintext secret values from annotations.
• Use cluster registration tokens or import URLs to re-enroll agents or compromise downstream clusters.
• Access clusters that rely on these tokens for authentication, enabling lateral movement.

Please consult the associated MITRE ATT&CK - Technique - Log Enumeration for further information about this category of attack.

CVE-2024-58269 has a CVSS score of 4.3 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.0.0-20251013203444-50dc516a19ea); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

This vulnerability is addressed by applying redaction to sensitive information that was leaking.

Patched versions of Rancher include release v2.12.3.

1. What is CVE-2024-58269? CVE-2024-58269 is a medium-severity security vulnerability in github.com/rancher/rancher (go), affecting versions < 0.0.0-20251013203444-50dc516a19ea. It is fixed in 0.0.0-20251013203444-50dc516a19ea.
2. How severe is CVE-2024-58269? CVE-2024-58269 has a CVSS score of 4.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of github.com/rancher/rancher are affected by CVE-2024-58269? github.com/rancher/rancher (go) versions < 0.0.0-20251013203444-50dc516a19ea is affected.
4. Is there a fix for CVE-2024-58269? Yes. CVE-2024-58269 is fixed in 0.0.0-20251013203444-50dc516a19ea. Upgrade to this version or later.
5. Is CVE-2024-58269 exploitable, and should I be worried? Whether CVE-2024-58269 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2024-58269 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2024-58269? Upgrade github.com/rancher/rancher to 0.0.0-20251013203444-50dc516a19ea or later.

Other vulnerabilities in github.com/rancher/rancher