CVE-2019-12274
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2019-12274
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-12274.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2019-12274
- Aliases
- Published
- 2019-06-06T16:29:01Z
- Modified
- 2025-07-01T07:01:18.099126Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.
- References
Affected packages
Git / github.com/rancher/rancher
Affected ranges
- Type
- GIT
- Repo
- https://github.com/rancher/rancher
- Events
-
IntroducedLast affectedIntroducedLast affected
Affected versions
1.*
1.1.4
1.4.3
1.6.0
agent-base-v0.*
agent-base-v0.2.0
agent-base-v0.3.0
agent-v1.*
agent-v1.0.1
agent-v1.0.2
agent-v1.1.0-rc10
agent-v1.1.0-rc11
agent-v1.1.0-rc12
agent-v1.1.0-rc13
agent-v1.1.0-rc14
agent-v1.1.0-rc15
agent-v1.1.0-rc16
agent-v1.1.0-rc17
agent-v1.1.0-rc2
agent-v1.1.0-rc3
agent-v1.1.0-rc4
agent-v1.1.0-rc5
agent-v1.1.0-rc7
agent-v1.1.0-rc9
agent-v1.1.1
agent-v1.1.1-rc1
agent-v1.1.2
agent-v1.1.3
agent-v1.2.0
agent-v1.2.0-rc1
agent-v1.2.0-rc2
agent-v1.2.1
agent-v1.2.1-rc1
agent-v1.2.1-rc2
agent-v1.2.10
agent-v1.2.10-rc1
agent-v1.2.10-rc2
agent-v1.2.10-rc3
agent-v1.2.10-rc5
agent-v1.2.10-rc6
agent-v1.2.11-rc1
agent-v1.2.2
agent-v1.2.2-rc1
agent-v1.2.3-rc2
agent-v1.2.4
agent-v1.2.5
agent-v1.2.6-rc1
agent-v1.2.7-rc1
agent-v1.2.8
agent-v1.2.8-rc1
agent-v1.2.9
agent-windows-v0.*
agent-windows-v0.1.0
agent-windows-v0.1.0-rc1
agent-windows-v0.2.0
rancher-agent-v1.*
rancher-agent-v1.2.4-rc1
v1.*
v1.0.0
v1.0.1
v1.0.1-rc1
v1.0.1-rc2
v1.0.1-rc3
v1.0.1-rc4
v1.0.1-rc5
v1.0.1-rc6
v1.0.1-rc7
v1.1.0
v1.1.0-dev1
v1.1.0-dev1-rc1
v1.1.0-dev1-rc2
v1.1.0-dev1-rc3
v1.1.0-dev2
v1.1.0-dev2-rc1
v1.1.0-dev2-rc2
v1.1.0-dev2-rc3
v1.1.0-dev2-rc4
v1.1.0-dev2-rc5
v1.1.0-dev2-rc6
v1.1.0-dev3
v1.1.0-dev3-rc1
v1.1.0-dev4
v1.1.0-dev4-rc1
v1.1.0-dev4-rc2
v1.1.0-dev5
v1.1.0-dev5-rc1
v1.1.0-dev5-rc2
v1.1.0-dev5-rc3
v1.1.0-dev5-rc4
v1.1.0-dev5-rc5
v1.1.0-rc1
v1.1.0-rc2
v1.1.0-rc3
v1.1.0-rc4
v1.1.0-rc5
v1.1.1
v1.1.1-rc1
v1.1.1-rc2
v1.1.1-rc3
v1.2.0
v1.2.0-pre1
v1.2.0-pre1-rc1
v1.2.0-pre1-rc2
v1.2.0-pre1-rc3
v1.2.0-pre1-rc4
v1.2.0-pre1-rc5
v1.2.0-pre1-rc6
v1.2.0-pre1-rc7
v1.2.0-pre2
v1.2.0-pre2-rc1
v1.2.0-pre2-rc2
v1.2.0-pre2-rc3
v1.2.0-pre2-rc4
v1.2.0-pre2-rc5
v1.2.0-pre2-rc6
v1.2.0-pre2-rc7
v1.2.0-pre3
v1.2.0-pre3-rc1
v1.2.0-pre3-rc2
v1.2.0-pre3-rc3
v1.2.0-pre3-rc4
v1.2.0-pre3-rc5
v1.2.0-pre4-rc1
v1.2.0-pre4-rc10
v1.2.0-pre4-rc11
v1.2.0-pre4-rc12
v1.2.0-pre4-rc13
v1.2.0-pre4-rc14
v1.2.0-pre4-rc15
v1.2.0-pre4-rc2
v1.2.0-pre4-rc3
v1.2.0-pre4-rc4
v1.2.0-pre4-rc5
v1.2.0-pre4-rc6
v1.2.0-pre4-rc7
v1.2.0-pre4-rc8
v1.2.0-pre4-rc9
v1.2.0-rc1
v1.2.0-rc2
v1.2.0-rc3
v1.2.0-rc4
v1.3.0
v1.3.0-rc1
v1.3.0-rc2
v1.3.0-rc3
v1.3.0-rc4
v1.3.0-rc5
v1.3.0-rc6
v1.4.0
v1.4.0-rc1
v1.4.0-rc2
v1.4.0-rc3
v1.4.0-rc4
v1.4.0-rc5
v1.4.0-rc6
v1.4.0-rc7
v1.4.0-rc8
v1.4.0-rc9
v1.5.0
v1.5.0-alpha1
v1.5.0-rc1
v1.5.0-rc2
v1.5.0-rc3
v1.5.0-rc4
v1.5.0-rc5
v1.5.0-rc6
v1.5.0-rc7
v1.5.0-rc8
v1.5.1
v1.5.1-rc1
v1.5.2
v1.5.2-rc1
v1.5.2-rc2
v1.5.2-rc3
v1.5.3-rc1
v1.5.3-try1
v1.5.3-try2
v1.5.4
v1.5.4-rc1
v1.5.4-rc2
v1.5.4-rc3
v1.5.5
v1.5.5-rc1
v1.5.6
v1.5.6-rc1
v1.5.6-rc2
v1.6.0
v1.6.0-rc1
v1.6.0-rc2
v1.6.0-rc3
v1.6.0-rc4
v1.6.0-rc5
v1.6.0-rc6
v1.6.1
v1.6.1-rc1
v1.6.1-rc10
v1.6.1-rc2
v1.6.1-rc3
v1.6.1-rc4
v1.6.1-rc5
v1.6.1-rc6
v1.6.1-rc7
v1.6.1-rc8
v1.6.1-rc9
v1.6.10
v1.6.10-rc1
v1.6.11
v1.6.11-rc1
v1.6.11-rc10
v1.6.11-rc2
v1.6.11-rc3
v1.6.11-rc4
v1.6.11-rc5
v1.6.11-rc6
v1.6.11-rc7
v1.6.11-rc8
v1.6.11-rc9
v1.6.12
v1.6.12-rc1
v1.6.13
v1.6.13-rc1
v1.6.13-rc2
v1.6.13-rc3
v1.6.13-rc4
v1.6.13-rc5
v1.6.13-rc6
v1.6.14
v1.6.14-rc1
v1.6.14-rc2
v1.6.15
v1.6.15-rc1
v1.6.15-rc2
v1.6.15-rc3
v1.6.15-rc4
v1.6.15-rc5
v1.6.15-rc6
v1.6.15-rc7
v1.6.15-rc8
v1.6.16
v1.6.16-rc1
v1.6.17
v1.6.17-rc1
v1.6.17-rc2
v1.6.17-rc3
v1.6.18
v1.6.18-rc1
v1.6.18-rc2
v1.6.18-rc3
v1.6.19
v1.6.19-rc1
v1.6.19-rc2
v1.6.19-rc3
v1.6.19-rc4
v1.6.19-rc5
v1.6.19-rc6
v1.6.19-rc7
v1.6.19-rc8
v1.6.2
v1.6.2-rc1
v1.6.20
v1.6.21
v1.6.22
v1.6.22-rc1
v1.6.22-rc2
v1.6.22-rc3
v1.6.22-rc4
v1.6.22-rc5
v1.6.23
v1.6.23-rc1
v1.6.24
v1.6.24-rc1
v1.6.24-rc2
v1.6.24-rc3
v1.6.24-rc4
v1.6.25
v1.6.25-rc1
v1.6.26
v1.6.26-rc1
v1.6.26-rc2
v1.6.26-rc3
v1.6.26-rc4
v1.6.26-rc5
v1.6.26-rc6
v1.6.26-rc7
v1.6.27
v1.6.28
v1.6.28-rc1
v1.6.28-rc2
v1.6.3
v1.6.3-rc1
v1.6.3-rc2
v1.6.3-rc3
v1.6.3-rc4
v1.6.3-rc5
v1.6.3-rc6
v1.6.3-rc7
v1.6.4
v1.6.5
v1.6.5-rc1
v1.6.5-rc2
v1.6.6
v1.6.6-rc1
v1.6.6-rc2
v1.6.6-rc3
v1.6.6-rc4
v1.6.6-rc5
v1.6.6-rc6
v1.6.6-rc7
v1.6.7
v1.6.7-rc1
v1.6.8
v1.6.8-rc1
v1.6.8-rc2
v1.6.8-rc3
v1.6.8-rc4
v1.6.8-rc5
v1.6.8-rc6
v1.6.8-rc7
v1.6.8-rc8
v1.6.9
v1.6.9-rc1
v1.6.9-rc2
v1.6.9-rc3
v1.6.9-rc4
v1.6.9-rc5
v2.*
v2.0.0
v2.0.0-rc5
v2.0.1
v2.0.1-rc1
v2.0.1-rc2
v2.0.1-rc3
v2.0.1-rc4
v2.0.1-rc5
v2.0.1-rc6
v2.0.2
v2.0.2-rc1
v2.0.3
v2.0.3-rc1
v2.0.3-rc2
v2.0.3-rc3
v2.0.3-rc4
v2.0.3-rc5
v2.0.4
v2.0.4-rc1
v2.0.5
v2.0.5-rc1
v2.0.5-rc2
v2.0.5-rc3
v2.0.5-rc4
v2.0.5-rc5
v2.0.5-rc6
v2.0.6
v2.0.6-rc1
v2.0.6-rc2
v2.0.7
v2.0.7-rc1
v2.0.7-rc2
v2.0.7-rc3
v2.0.7-rc4
v2.0.7-rc5
v2.0.7-rc6
v2.0.8
v2.0.8-rc2
v2.0.8-rc3
v2.0.8-rc4
v2.0.8-rc5
v2.0.8-rc6
v2.1.0
v2.1.0-rc1
v2.1.0-rc10
v2.1.0-rc2
v2.1.0-rc3
v2.1.0-rc4
v2.1.0-rc5
v2.1.0-rc6
v2.1.0-rc7
v2.1.0-rc8
v2.1.0-rc9
v2.2.0
v2.2.0-rc1
v2.2.0-rc10
v2.2.0-rc11
v2.2.0-rc12
v2.2.0-rc13
v2.2.0-rc14
v2.2.0-rc15
v2.2.0-rc2
v2.2.0-rc3
v2.2.0-rc4
v2.2.0-rc5
v2.2.0-rc6
v2.2.0-rc7
v2.2.0-rc8
v2.2.0-rc9
v2.2.1
v2.2.1-rc1
v2.2.2
v2.2.2-patch1-rc1
v2.2.2-patch1-rc2
v2.2.2-rc1
v2.2.2-rc10
v2.2.2-rc11
v2.2.2-rc12
v2.2.2-rc13
v2.2.2-rc14
v2.2.2-rc2
v2.2.2-rc3
v2.2.2-rc4
v2.2.2-rc5
v2.2.2-rc6
v2.2.2-rc7
v2.2.2-rc8
v2.2.2-rc9
v2.2.3
windows-agent-v0.*
windows-agent-v0.2.0-rc1
windows-agent-v0.2.0-rc2