CVE-2023-32186
Quick assessment
Affected
SUSE RKE2
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
RKE2是Rancher 的下一代 Kubernetes 发行版。 SUSE RKE2存在安全漏洞，该漏洞源于存在资源分配错误问题。攻击者可利用该漏洞访问K3s服务器的apiserver/supervisor端口，导致拒绝服务。受影响的产品和版本：SUSE RKE2 1.24.17+rke2r1之前版本，v1.25.13+rke2r1之前版本， v1.26.8+rke2r1之前版本，v1.27.5+rke2r1之前版本， v1.28.1+rke2r1之前版本。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-32186
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service.
This issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0 before v1.26.8+rke2r1, from v1.27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
RKE2 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
RKE2是Rancher 的下一代 Kubernetes 发行版。 SUSE RKE2存在安全漏洞，该漏洞源于存在资源分配错误问题。攻击者可利用该漏洞访问K3s服务器的apiserver/supervisor端口，导致拒绝服务。受影响的产品和版本：SUSE RKE2 1.24.17+rke2r1之前版本，v1.25.13+rke2r1之前版本， v1.26.8+rke2r1之前版本，v1.27.5+rke2r1之前版本， v1.28.1+rke2r1之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-32186
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 8301 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2023-32186
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-32186 (2)
IV. Related Vulnerabilities
Same vendor: SUSE
-
CVE-2026-88804
Unauthenticated update of public UI settings leading to stor -
CVE-2026-88805
Session Not Revoked Server-Side on Logout in Rancher -
CVE-2026-88808
Fleet agent copies downstream resources with cluster-admin p -
CVE-2026-93540
Fleet applies namespace labels and annotations without the b -
CVE-2026-93539
Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook
Same weakness: CWE-770
-
CVE-2026-1403
Allocation of Resources Without Limits or Throttling in GitL -
CVE-2026-107212
Excelize: Unbounded row number in Rows.Columns makes GetRows -
CVE-2026-20173
Cisco NX-OS Software Denial of Service Vulnerability -
CVE-2026-107166
Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_cr -
CVE-2026-106569
ImageMagick: Denial of service in ASE decoder because of mis
V. Comments for CVE-2023-32186
No comments yet