What’s Vulnerable › Vulnerabilities

CVE-2024-52284: Rancher Fleet Helm Values are stored inside BundleDeployment in plain text

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-02 · updated 2026-06-17
• Weakness: CWE-312

Description

Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.

Affected products

• SUSE Rancher: from 0.13.0 before 0.13.1-0.20250806151509-088bcbea7edb; from 0.12.0 before 0.12.6; from 0.11.0 before 0.11.10 — fixed in 0.11.10, 0.12.6, 0.13.1-0.20250806151509-088bcbea7edb

How to fix

Upgrade to a fixed version: SUSE Rancher 0.11.10, 0.12.6, 0.13.1-0.20250806151509-088bcbea7edb. Check the vendor advisory for mitigations.

References

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52284
• https://github.com/advisories/GHSA-6h9x-9j5v-7w9h

Get alerted when CVE-2024-52284 or the next vulnerability affects your stack