NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
MEDIUM severity

CVE-2024-58269 — rancher

MEDIUMFix: rancher/rancher@26ad921

CVE-2024-58269 is a medium-severity (CVSS 4.3) CWE-532 vulnerability in github.com/rancher/rancher. A fix is available for github.com/rancher/rancher — see the affected versions and patch details below.

Rancher exposes sensitive information through audit logs

Also known asGO-2025-4074
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2024-58269.

EPSS Exploitation Probability

via FIRST.org ↗
0.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs22th percentile — riskier than 22% of all scored CVEsHighest risk
0.00%0.26%0.53%0.79%0.0%0.3%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐹github.com/rancher/rancher

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Note: The exploitation of this issue requires that the malicious user have access to Rancher’s audit log storage.

A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs. This happens in two different ways:

  1. Secret Annotation Leakage: When creating Kubernetes Secrets using the stringData field, the cleartext value is embedded in the kubectl.kubernetes.io/last-applied-configuration annotation. This annotation is included in Rancher audit logs within both the request and response bodies, exposing secret material that should be redacted.
  2. Cluster Registration Token Leakage: During the import or creation of downstream clusters (Custom, Imported, or Harvester), Rancher audit logs record full cluster registration manifests and tokens, including: a. Non-expiring import URLs such as /v3/import/<token>_c-m-xxxx.yaml. b. Full kubectl apply and curl commands containing registration tokens and CA checksums. c. Token values associated with cluster registration resources (clusterRegistrationToken). d. These tokens are valid until explicitly revoked and can be used to re-register nodes, granting unauthorized cluster access.

An attacker or internal user who gains access to these logs could:

  • Recover plaintext secret values from annotations.
  • Use cluster registration tokens or import URLs to re-enroll agents or compromise downstream clusters.
  • Access clusters that rely on these tokens for authentication, enabling lateral movement.

Please consult the associated MITRE ATT&CK - Technique - Log Enumeration for further information about this category of attack.

Patches

This vulnerability is addressed by applying redaction to sensitive information that was leaking.

Patched versions of Rancher include release v2.12.3.

Workarounds

If the deployment can't be upgraded to a fixed version, users are encouraged to create AuditPolicies to redact and filter some of those requests as described in our documentation.

The following AuditPolicy can be applied to redact the secrets:

apiVersion: auditlog.cattle.io/v1
kind: AuditPolicy
metadata:
  name: redactions
spec:
  enabled: true
  additionalRedactions:
    - headers:
      - "Referer"
    - paths:
      - "$..metadata.annotations['kubectl.kubernetes.io/last-applied-configuration']"

Also consider granting access to Rancher's logs only for trusted users.

References

If you have any questions or comments about this advisory:

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/rancher/rancherall versions0.0.0-20251013203444-50dc516a19eago get github.com/rancher/rancher@v0.0.0-20251013203444-50dc516a19ea

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/rancher/rancher, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/rancher/rancher to 0.0.0-20251013203444-50dc516a19ea or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-58269 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact **Note: The exploitation of this issue requires that the malicious user have access to Rancher’s audit log storage.** A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs. This happens in two different ways: 1. Secret Annotation Leakage: When creating Kubernetes Secrets using the `stringData` field, the cleartext value is embedded in the `kubectl.kubernetes.io/last-applied-configuration` annotation. This annotation is inclu
O3 Security · Impact-Aware SCA

Is CVE-2024-58269 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2024-58269: rancher — Fix Available