Skip to content

Commit c7859da

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5qjg-9mjh-4r92 GHSA-mw39-9qc2-f7mg
1 parent ee13141 commit c7859da

File tree

2 files changed

+129
-0
lines changed

2 files changed

+129
-0
lines changed

‎advisories/github-reviewed/2025/10/GHSA-5qjg-9mjh-4r92/GHSA-5qjg-9mjh-4r92.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5qjg-9mjh-4r92",
4+
"modified": "2025-10-24T15:27:04Z",
5+
"published": "2025-10-24T15:27:04Z",
6+
"aliases": [
7+
"CVE-2025-62714"
8+
],
9+
"summary": "Karmada Dashboard API Unauthorized Access Vulnerability ",
10+
"details": "### Impact\nThis is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints (e.g., /api/v1/secret, /api/v1/service) did not enforce authentication, allowing unauthenticated users to access sensitive cluster information such as Secrets and Services directly. Although the web UI required a valid JWT for access, the API itself remained exposed to direct requests without any authentication checks. Any user or entity with network access to the Karmada Dashboard service could exploit this vulnerability to retrieve sensitive data.\n\n### Patches\nThe issue has been fixed in Karmada Dashboard v0.2.0. This release enforces authentication for all API endpoints. Users are strongly advised to upgrade to version v0.2.0 or later as soon as possible.\n\n### Workarounds\nIf upgrading is not immediately feasible, users can mitigate the risk by:\n\n- Restricting network access to the Karmada Dashboard service using Kubernetes Network Policies, firewall rules, or ingress controls.\n- Placing the Dashboard behind a reverse proxy that enforces authentication (e.g., OAuth2 proxy) to add an additional layer of security.\n\n### References\n- Karmada Dashboard v0.2.0 Release : https://github.com/karmada-io/dashboard/releases/tag/v0.2.0\n- Fix PR #271\n- Fix PR #280",
11+
"severity": [],
12+
"affected": [
13+
{
14+
"package": {
15+
"ecosystem": "Go",
16+
"name": "github.com/karmada-io/dashboard"
17+
},
18+
"ranges": [
19+
{
20+
"type": "ECOSYSTEM",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.2.0"
27+
}
28+
]
29+
}
30+
]
31+
}
32+
],
33+
"references": [
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/karmada-io/dashboard/security/advisories/GHSA-5qjg-9mjh-4r92"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/karmada-io/dashboard/pull/271"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/karmada-io/dashboard/pull/280"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/karmada-io/dashboard"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/karmada-io/dashboard/releases/tag/v0.2.0"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-862"
58+
],
59+
"severity": "CRITICAL",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2025-10-24T15:27:04Z",
62+
"nvd_published_at": null
63+
}
64+
}

‎advisories/github-reviewed/2025/10/GHSA-mw39-9qc2-f7mg/GHSA-mw39-9qc2-f7mg.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mw39-9qc2-f7mg",
4+
"modified": "2025-10-24T15:27:13Z",
5+
"published": "2025-10-24T15:27:13Z",
6+
"aliases": [
7+
"CVE-2024-58269"
8+
],
9+
"summary": "Rancher exposes sensitive information through audit logs",
10+
"details": "### Impact\n**Note: The exploitation of this issue requires that the malicious user have access to Rancher’s audit log storage.**\n\nA vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs. This happens in two different ways:\n\n1. Secret Annotation Leakage: When creating Kubernetes Secrets using the `stringData` field, the cleartext value is embedded in the `kubectl.kubernetes.io/last-applied-configuration` annotation. This annotation is included in Rancher audit logs within both the request and response bodies, exposing secret material that should be redacted.\n2. Cluster Registration Token Leakage: During the import or creation of downstream clusters (Custom, Imported, or Harvester), Rancher audit logs record full cluster registration manifests and tokens, including:\na. Non-expiring import URLs such as `/v3/import/<token>_c-m-xxxx.yaml`.\nb. Full `kubectl apply` and `curl` commands containing registration tokens and CA checksums.\nc. Token values associated with cluster registration resources (`clusterRegistrationToken`).\nd. These tokens are valid until explicitly revoked and can be used to re-register nodes, granting unauthorized cluster access.\n\nAn attacker or internal user who gains access to these logs could:\n- Recover plaintext secret values from annotations.\n- Use cluster registration tokens or import URLs to re-enroll agents or compromise downstream clusters.\n- Access clusters that rely on these tokens for authentication, enabling lateral movement.\n\nPlease consult the associated [MITRE ATT&CK - Technique - Log Enumeration](https://attack.mitre.org/techniques/T1654/) for further information about this category of attack.\n\n### Patches\nThis vulnerability is addressed by applying redaction to sensitive information that was leaking.\n\nPatched versions of Rancher include release `v2.12.3`.\n\n### Workarounds\nIf the deployment can't be upgraded to a fixed version, users are encouraged to create `AuditPolicies` to redact and filter some of those requests as described in our [documentation](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-policies).\n\nAlso consider granting access to Rancher's logs only for trusted users.\n\n### References\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/rancher/rancher"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.0.0-20251013203444-50dc516a19ea"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-mw39-9qc2-f7mg"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/rancher/rancher/commit/26ad9216e94f77b5471f638256a6989030572adc"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/rancher/rancher/commit/50dc516a19ea216e270f738912dc8d0c9ca99d5d"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/rancher/rancher"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-532"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-10-24T15:27:13Z",
63+
"nvd_published_at": null
64+
}
65+
}

0 commit comments

Comments
 (0)