CVE-2022-45157: Exposure of vSphere's CPI and CSI credentials in Rancher

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-13 · updated 2026-06-17
Weakness: CWE-522

Description

A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.

Affected products

SUSE Rancher: from 2.9.0 before 2.9.3; from 2.7.0 before 2.8.9 — fixed in 2.8.9, 2.9.3

How to fix

Upgrade to a fixed version: SUSE Rancher 2.8.9, 2.9.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-45157 or the next vulnerability affects your stack