CVE-2024-22032

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling, the Kube API secret values are written in plaintext on the AppliedSpec. Cluster owners, Cluster members, and Project members (for projects within the cluster), all have RBAC permissions to view the cluster object from the apiserver.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-220336.3The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to CVE-2024-220345.5Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configu CVE-2024-220369.1A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root acces CVE-2024-220375.5The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be sho CVE-2024-220387.3Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of se CVE-2024-220399.8A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All vers CVE-2024-22045.5Zemana AntiLogger v2.74.204.664 is vulnerable to a Denial of Service (DoS) vulnerability by triggering the 0x80002004 and 0x80002010 IOCTL c CVE-2024-220407.5A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions),CVE-2024-220417.5A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions),CVE-2024-220427.8A vulnerability has been identified in Unicam FX (All versions). The windows installer agent used in affected product contains incorrect use CVE-2024-220435.5A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.251), Parasolid V35.1 (All versions < V35.1.170). The affected CVE-2024-220447.5A vulnerability has been identified in SENTRON 3KC ATC6 Expansion Module Ethernet (3KC9000-8TL75) (All versions). Affected devices expose an