CVE-2023-32191 rke's credentials are stored in the RKE1 Cluster state ConfigMap
Attackers with read access to the kube-system namespace can retrieve admin credentials from the cluster state ConfigMap, enabling privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32191?
CVE-2023-32191 is a critical vulnerability in SUSE rke, published on 16 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin.
Weakness: CWE-922
Which versions are affected by CVE-2023-32191?
5 open source packages ship an affected version, including github.com/rancher/rke.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rancher/rke Go | From 1.4.18 | 1.4.19, 1.5.10 |
github.com/rancher/rke Go | From 1.4.18 | 1.4.19 |
github.com/rancher/rke Go | From 1.4.18 | 1.4.19 |
github.com/rancher/rke Go | From 1.5.9 | 1.5.10 |
github.com/rancher/rke Go | From 1.5.9 | 1.5.10 |
How do I fix CVE-2023-32191?
Upgrade github.com/rancher/rke to a fixed version for your release line: 1.4.19 or 1.5.10.
Is CVE-2023-32191 being exploited?
There is no known exploitation of CVE-2023-32191 in the wild and no public exploit code.
Sources
Also known as GHSA-6gr4-52w6-vmqx, GO-2024-2930.