CVE-2023-22647
HIGH
MEDIUM
Priority: 0.06
BB Relevance:
51/100
Published: 2023-06-01
Modified: 2026-10-23
First seen: 2026-10-29
Status: active
Attack Surface
Adjacent
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the local cluster. This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4.
Weakness Classification (1)
References & Advisories (2)
Vendor Advisory
Issue Tracking
Vendor Advisory