{"id":"CVE-2023-32191","summary":"rke's credentials are stored in the RKE1 Cluster state ConfigMap","details":"When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin.","aliases":["GHSA-6gr4-52w6-vmqx","GO-2024-2930"],"modified":"2026-09-06T11:46:49.384215984Z","published":"2024-10-16T12:17:02.324Z","database_specific":{"cna_assigner":"suse","cwe_ids":["CWE-922"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32191.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32191.json"},{"type":"ADVISORY","url":"https://github.com/rancher/rke/security/advisories/GHSA-6gr4-52w6-vmqx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32191"},{"type":"REPORT","url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32191"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rancher-archives/rke","events":[{"introduced":"a70250c6d817f8ebf1e2c1112752e95dc4c63908"},{"fixed":"6f3859aa3ce82b34d324f781c0e72a504af5ca42"},{"introduced":"08e8d6dddf32263658a7ba2d05eba26780c57556"},{"fixed":"ec0661a037c39c13e13a0eaedea7e57df09d3435"}],"database_specific":{"extracted_events":[{"introduced":"1.4.18"},{"fixed":"1.4.19"},{"introduced":"1.5.9"},{"fixed":"1.5.10"}],"source":"AFFECTED_FIELD"}}],"versions":["v1.5.10-rc.1","v1.4.19-rc.1","v1.5.9","v1.4.18"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32191.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}