Rancher advisory. Github link below. Posted 10 days ago. Please make sure you've updated and patched.

<https://portswigger.net/daily-swig/rancher-stored-sensitive-values-in-plaintext-exposed-kubernetes-clusters-to-takeover>

With minimal access privs, one can obtain the cluster token in Rancher versions up to and including 2.5.15 and 2.6.6

An issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where sensitive fields, like passwords, API keys and Rancher's service account token (used to provision clusters), were stored in plaintext directly on Kubernetes objects like Clusters, for example cluster.management.cattle.io. Anyone with read access to those objects in the Kubernetes API could retrieve the plaintext version of those sensitive data.

The exposed credentials are visible in Rancher to authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base on the endpoints:

<https://github.com/advisories/GHSA-g7j7-h4q8-8w2f>