CVE-2024-52284
published 2025-09-02CVE-2024-52284: Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing…
PriorityP341high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.22%
12.2th percentile
Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | rancher_fleet | >= 0.11.0 < 0.11.10 | 0.11.10 |
| github.com | rancher_fleet | >= 0.12.0 < 0.12.6 | 0.12.6 |
| github.com | rancher_fleet | >= 0.13.0 < 0.13.1-0.20250806151509-088bcbea7edb | 0.13.1-0.20250806151509-088bcbea7edb |
| suse | rancher | >= 0.11.0 < 0.11.10 | 0.11.10 |
| suse | rancher | >= 0.12.0 < 0.12.6 | 0.12.6 |
| suse | rancher | >= 0.13.0 < 0.13.1-0.20250806151509-088bcbea7edb | 0.13.1-0.20250806151509-088bcbea7edb |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
osv7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet
osv·2025-09-08
CVE-2024-52284 Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet
Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet
Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet
OSV
CVE-2024-52284: Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values contai
osv·2025-09-02·CVSS 7.7
CVE-2024-52284 [HIGH] CVE-2024-52284: Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values contai
Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.
GHSA
Rancher Fleet Helm Values are stored inside BundleDeployment in plain text
ghsa·2025-08-29
CVE-2024-52284 [HIGH] CWE-312 Rancher Fleet Helm Values are stored inside BundleDeployment in plain text
Rancher Fleet Helm Values are stored inside BundleDeployment in plain text
### Impact
A vulnerability has been identified when using Fleet to manage Helm charts where sensitive information is passed through `BundleDeployment.Spec.Options.Helm.Values` may be stored in plain text. This can result in:
1. Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.
2. Lack of encryption at rest: `BundleDeployment` is not configured for Kubernetes encryption at rest by default, causing sensitive values to remain unencrypted within the cluster datastore.
This behavior differs from Helm v3’s default approach, where chart state — including values — is stored in Kubernetes s
OSV
Rancher Fleet Helm Values are stored inside BundleDeployment in plain text
osv·2025-08-29
CVE-2024-52284 [HIGH] Rancher Fleet Helm Values are stored inside BundleDeployment in plain text
Rancher Fleet Helm Values are stored inside BundleDeployment in plain text
### Impact
A vulnerability has been identified when using Fleet to manage Helm charts where sensitive information is passed through `BundleDeployment.Spec.Options.Helm.Values` may be stored in plain text. This can result in:
1. Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.
2. Lack of encryption at rest: `BundleDeployment` is not configured for Kubernetes encryption at rest by default, causing sensitive values to remain unencrypted within the cluster datastore.
This behavior differs from Helm v3’s default approach, where chart state — including values — is stored in Kubernetes s
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-02
Published