CVE-2023-22647

HighCVSS 8.0/10Last modified Oct 23, 2026

Description

An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the local cluster.

This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-267

Affected software

Vendor	Product	Versions
SUSE	Rancher	>= >= 2.6.0, < < 2.6.13; >= >= 2.7.0, < < 2.7.4

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22647Issue Tracking, Vendor Advisory
https://github.com/rancher/rancher/security/advisories/GHSA-p976-h52c-26p6Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22647Issue Tracking, Vendor Advisory
https://github.com/rancher/rancher/security/advisories/GHSA-p976-h52c-26p6Vendor Advisory

Timeline

Published: Jun 1, 2023
Last modified: Oct 23, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-226488.8A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they CVE-2023-226496.5A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https:/CVE-2023-22656.1An Improper Restriction of Rendered UI Layers or Frames in the Schweitzer Engineering Laboratories SEL-411L could allow an unauthenticated a CVE-2023-226508.8A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authe CVE-2023-226519.9Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admissio CVE-2023-226526.5A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed confi CVE-2023-226538.8An OS command injection vulnerability exists in the vtysh_ubus tcpdump_start_cb functionality of Milesight UR32L v32.3.0.5. A specially craf CVE-2023-226545.4Client-side enforcement of server-side security issue exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may lead to CVE-2023-226556.1Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a CVE-2023-226563.9Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentia CVE-2023-226577.8On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file name CVE-2023-226597.2An os command injection vulnerability exists in the libzebra.so change_hostname functionality of Milesight UR32L v32.3.0.5. A specially-craf