github.com/rancher/rke2

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

1. Critical, CVSS 9.1GoPublished 25 Oct 2024

   RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists

   GHSA-x7xj-jvwp-97rv

   Affected

   • Go github.com/rancher/rke2 >= 1.27.0, < 1.27.15; >= 1.28.0, < 1.28.11; >= 1.29.0, < 1.29.6; >= 1.30.0, < 1.30.2

   Fixed in

   1.30.21.28.111.29.61.27.15· Vendor fix available

   Issue

   Impact A vulnerability has been identified whereby RKE2 deployments in Windows nodes have weak Access Control Lists (ACL), allowing BUILTIN\Users or NT AUTHORITY\Authenticated Users to view or edit sensitive files which could lead to privilege escalation. The affected files include binaries, scripts, configuration and log files: This vulnerability is exclusive to RKE2 in Windows environments. Linux environments are not affected by it. Please consult the associated MITRE ATT&CK - Technique - Exploitation for Privilege Escalation for further information about this category of attack. Patches Patched versions include RKE2 1.31.0, 1.30.2, 1.29.6, 1.28.11 and 1.27.15. Workarounds Users are advised to do a fresh install of their RKE2 Windows nodes using a patched RKE2 version. When that is not possible, users can enforce stricter ACLs for all sensitive files affected by this Security Advisory running this PowerShell script as an Administrator on each node. References - CVE-2023-32197 -…

   Recommended action: Upgrade to 1.30.2, 1.29.6, 1.28.11 or 1.27.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 15:05 UTCEvidence →
2. High, CVSS 7.5GoPublished 11 Sep 2023

   RKE2 supervisor port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack

   CVE-2023-32186 · GHSA-p45j-vfv5-wprq

   Affected

   • Go github.com/rancher/rke2 < 1.24.17; >= 1.25.0, < 1.25.13; >= 1.26.0, < 1.26.8; >= 1.27.0, < 1.27.5; >= 1.28.0, < 1.28.1

   Fixed in

   1.25.131.24.171.26.81.27.51.28.1· Vendor fix available

   Issue

   Impact An issue was found in RKE2 where an attacker with network access to RKE2 servers' supervisor port (TCP 9345) can force the TLS server to add entries to the certificate's Subject Alternative Name (SAN) list, through a stuffing attack, until the certificate grows so large that it exceeds the maximum size allowed by TLS client implementations. OpenSSL for example will raise an excessive message size error when this occurs. No authentication is necessary to perform this attack, only the ability to perform a TLS handshake against the supervisor port (TCP 9345). Affected servers will continue to operate, but clients (server or agent nodes) will fail to establish new connections when joining or rejoining the cluster, thus leading to a denial of service (DoS) attack. Remediation Upgrade to a fixed release: - v1.28.1+rke2r1 - v1.27.5+rke2r1 - v1.26.8+rke2r1 - v1.25.13+rke2r1 - 1.24.17+rke2r1 If you are using RKE2 1.27 or earlier, you must also add the parameter tls-san-security: true…

   Recommended action: Upgrade to 1.28.1, 1.27.5, 1.26.8 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 15:00 UTCEvidence →