Security Digest · Critical advisory (no CVE assigned)
GHSA-x7xj-jvwp-97rv: RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists
Impact A vulnerability has been identified whereby RKE2 deployments in Windows nodes have weak Access Control Lists (ACL), allowing BUILTIN\Users or NT AUTHORITY\Authenticated Users to view or edit sensitive files which could lead to privilege escalation.
CVSS 9.1 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
govulncheck ./.... - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Go | github.com/rancher/rke2 | >= 1.27.0, < 1.27.15 | 1.27.15 |
| Go | github.com/rancher/rke2 | >= 1.28.0, < 1.28.11 | 1.28.11 |
| Go | github.com/rancher/rke2 | >= 1.29.0, < 1.29.6 | 1.29.6 |
| Go | github.com/rancher/rke2 | >= 1.30.0, < 1.30.2 | 1.30.2 |
Details
Impact
A vulnerability has been identified whereby RKE2 deployments in Windows nodes have weak Access Control Lists (ACL), allowing BUILTIN\Users or NT AUTHORITY\Authenticated Users to view or edit sensitive files which could lead to privilege escalation.
The affected files include binaries, scripts, configuration and log files:
This vulnerability is exclusive to RKE2 in Windows environments. Linux environments are not affected by it.
Please consult the associated MITRE ATT&CK - Technique - Exploitation for Privilege Escalation for further information about this category of attack.
Patches
Patched versions include RKE2 1.31.0, 1.30.2, 1.29.6, 1.28.11 and 1.27.15.
Workarounds
CVSS: 9.1 (v3.1) CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Sources and references
- GitHub Advisory GHSA-x7xj-jvwp-97rv github.com
- github.com github.com
- github.com github.com
- cve.mitre.org cve.mitre.org