CVE-2024-52280
published 2025-04-11CVE-2024-52280: A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to…
PriorityP342high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.44%
36.3th percentile
A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to access, when they have at least some generic permissions on the type.
This issue affects rancher: before 2175e09, before 6e30359, before c744f0b.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | rancher_steve | >= 0 < 0.0.0-20241029132712-2175e090fe4b | 0.0.0-20241029132712-2175e090fe4b |
| suse | rancher | < 2175e09 | 2175e09 |
| suse | rancher | < 6e30359 | 6e30359 |
| suse | rancher | < c744f0b | c744f0b |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
github.com/rancher/steve's users can issue watch commands for arbitrary resources in github.com/rancher/steve
osv·2024-11-21
CVE-2024-52280 github.com/rancher/steve's users can issue watch commands for arbitrary resources in github.com/rancher/steve
github.com/rancher/steve's users can issue watch commands for arbitrary resources in github.com/rancher/steve
github.com/rancher/steve's users can issue watch commands for arbitrary resources in github.com/rancher/steve
GHSA
github.com/rancher/steve's users can issue watch commands for arbitrary resources
ghsa·2024-11-20
CVE-2024-52280 [HIGH] CWE-200 github.com/rancher/steve's users can issue watch commands for arbitrary resources
github.com/rancher/steve's users can issue watch commands for arbitrary resources
### Impact
A vulnerability has been discovered in Steve API (Kubernetes API Translator) in which users can watch resources they are not allowed to access, when they have at least some generic permissions on the type. For example, a user who can get a single secret in a single namespace can get all secrets in every namespace.
During a `watch` request for a single ID, the following occurs:
- In the case of a watch request for a single resource, Steve API will return a partition with the requested resource in it. In other cases, it will check the user's access when constructing partitions.
- When a watch request for a single resource is issued, instead of using a client which impersonates the user making the r
OSV
github.com/rancher/steve's users can issue watch commands for arbitrary resources
osv·2024-11-20
CVE-2024-52280 [HIGH] github.com/rancher/steve's users can issue watch commands for arbitrary resources
github.com/rancher/steve's users can issue watch commands for arbitrary resources
### Impact
A vulnerability has been discovered in Steve API (Kubernetes API Translator) in which users can watch resources they are not allowed to access, when they have at least some generic permissions on the type. For example, a user who can get a single secret in a single namespace can get all secrets in every namespace.
During a `watch` request for a single ID, the following occurs:
- In the case of a watch request for a single resource, Steve API will return a partition with the requested resource in it. In other cases, it will check the user's access when constructing partitions.
- When a watch request for a single resource is issued, instead of using a client which impersonates the user making the r
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-04-11
Published