CVE-2024-58269
published 2025-10-29CVE-2024-58269: A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.27%
18.8th percentile
A vulnerability has been identified in Rancher Manager, where sensitive
information, including secret data, cluster import URLs, and
registration tokens, is exposed to any entity with access to Rancher
audit logs.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | rancher_rancher | >= 0 < 0.0.0-20251013203444-50dc516a19ea | 0.0.0-20251013203444-50dc516a19ea |
| suse | rancher | < 0.0.0-20251013203444-50dc516a19ea | 0.0.0-20251013203444-50dc516a19ea |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Rancher exposes sensitive information through audit logs in github.com/rancher/rancher
osv·2025-10-30
CVE-2024-58269 Rancher exposes sensitive information through audit logs in github.com/rancher/rancher
Rancher exposes sensitive information through audit logs in github.com/rancher/rancher
Rancher exposes sensitive information through audit logs in github.com/rancher/rancher
OSV
Rancher exposes sensitive information through audit logs
osv·2025-10-24
CVE-2024-58269 [MEDIUM] Rancher exposes sensitive information through audit logs
Rancher exposes sensitive information through audit logs
### Impact
**Note: The exploitation of this issue requires that the malicious user have access to Rancher’s audit log storage.**
A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs. This happens in two different ways:
1. Secret Annotation Leakage: When creating Kubernetes Secrets using the `stringData` field, the cleartext value is embedded in the `kubectl.kubernetes.io/last-applied-configuration` annotation. This annotation is included in Rancher audit logs within both the request and response bodies, exposing secret material that should be redacted.
2. Cluster Registrati
GHSA
Rancher exposes sensitive information through audit logs
ghsa·2025-10-24
CVE-2024-58269 [MEDIUM] CWE-532 Rancher exposes sensitive information through audit logs
Rancher exposes sensitive information through audit logs
### Impact
**Note: The exploitation of this issue requires that the malicious user have access to Rancher’s audit log storage.**
A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs. This happens in two different ways:
1. Secret Annotation Leakage: When creating Kubernetes Secrets using the `stringData` field, the cleartext value is embedded in the `kubectl.kubernetes.io/last-applied-configuration` annotation. This annotation is included in Rancher audit logs within both the request and response bodies, exposing secret material that should be redacted.
2. Cluster Registrati
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-29
Published