CVE-2024-52284 — Rancher Fleet Helm Values are stored inside BundleDeployment in plain text

CVE-2024-52284

Rancher Fleet Helm Values are stored inside BundleDeployment in plain text PUBLISHED

Description (CNA)

Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.

Affected (CNA)

Vendor / product	Versions
SUSE / Rancher	affected 0.13.0 before 0.13.1-0.20250806151509-088bcbea7edb; affected 0.12.0 before 0.12.6; affected 0.11.0 before 0.11.10

CWE

CWE-312

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52284
https://github.com/advisories/GHSA-6h9x-9j5v-7w9h

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.