Medium severity · published Oct 29, 2025
CVE-2024-58269
Rancher exposes sensitive information through audit logs
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been identified in Rancher Manager, where sensitive
information, including secret data, cluster import URLs, and
registration tokens, is exposed to any entity with access to Rancher
audit logs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
rancher · SUSE
before 0.0.0-20251013203444-50dc516a19ea · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-58269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-58269
bugzilla.suse.com
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-58269
github.com
https://github.com/rancher/rancher/security/advisories/GHSA-mw39-9qc2-f7mg
More from rancher
9.9
CVE-2026-44935
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
9.9
CVE-2026-41050
Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
9.9
CVE-2025-62878
Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern
9.9
CVE-2023-22651
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation
9.9
CVE-2021-36783
Rancher: Failure to properly sanitize credentials in cluster template answers