CVE-2024-22030— Rancher agents can be hijacked by taking over the Rancher Server URL
Quick assessment
Affected
SUSE rancher
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Rancher是美国Rancher开源的一个开源容器管理平台，专为在生产环境中部署容器的组织而构建。 Rancher存在信任管理问题漏洞，该漏洞源于在特定情况下可以通过中间人(MITM)攻击来劫持Rancher代理。
Possible ATT&CK Techniques 1 AI
T1498 · Network Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-22030
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rancher agents can be hijacked by taking over the Rancher Server URL
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been identified within Rancher that can be exploited
in narrow circumstances through a man-in-the-middle (MITM) attack. An
attacker would need to have control of an expired domain or execute a
DNS spoofing/hijacking attack against the domain to exploit this
vulnerability. The targeted domain is the one used as the Rancher URL.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Rancher 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Rancher是美国Rancher开源的一个开源容器管理平台，专为在生产环境中部署容器的组织而构建。 Rancher存在信任管理问题漏洞，该漏洞源于在特定情况下可以通过中间人(MITM)攻击来劫持Rancher代理。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-22030
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 9242 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2024-22030
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-22030 (2)
Same Patch Batch · SUSE · 2024-10-16 · 15 CVEs total
| CVE-2023-32191 | 9.9 CRITICAL | rke's credentials are stored in the RKE1 Cluster state ConfigMap |
| CVE-2023-22650 | 8.8 HIGH | Rancher does not automatically clean up a user deleted or disabled from the configured Aut |
| CVE-2023-22649 | 8.4 HIGH | Rancher 'Audit Log' leaks sensitive information |
| CVE-2023-32193 | 8.3 HIGH | Norman API Cross-site Scripting Vulnerability |
| CVE-2023-32192 | 8.3 HIGH | Rancher API Server Cross-site Scripting Vulnerability |
| CVE-2024-22029 | 7.8 HIGH | tomcat packaging allows for escalation to root from tomcat user |
| CVE-2023-32194 | 7.2 HIGH | Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespac |
| CVE-2023-32196 | 6.6 MEDIUM | Rancher's External RoleTemplates can lead to privilege escalation |
| CVE-2024-22032 | 6.5 MEDIUM | Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec |
| CVE-2024-22033 | 6.3 MEDIUM | obs-service-download_url is vulnerable to argument injection |
| CVE-2023-32189 | 5.9 MEDIUM | Insecure handling SSH key in SUSE Manager when bootstrapping new clients |
| CVE-2024-22034 | 5.5 MEDIUM | Crafted projects can overwrite special files in the .osc config directory |
| CVE-2023-32190 | mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable | |
| CVE-2023-32188 | JWT token compromise can allow malicious actions including Remote Code Execution (RCE) |
IV. Related Vulnerabilities
Same product: rancher
-
CVE-2026-88804
Unauthenticated update of public UI settings leading to stor -
CVE-2026-88805
Session Not Revoked Server-Side on Logout in Rancher -
CVE-2026-88808
Fleet agent copies downstream resources with cluster-admin p -
CVE-2026-93540
Fleet applies namespace labels and annotations without the b -
CVE-2026-93539
Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook
Same vendor: SUSE
-
CVE-2026-88804
Unauthenticated update of public UI settings leading to stor -
CVE-2026-88805
Session Not Revoked Server-Side on Logout in Rancher -
CVE-2026-88808
Fleet agent copies downstream resources with cluster-admin p -
CVE-2026-93540
Fleet applies namespace labels and annotations without the b -
CVE-2026-93539
Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook
Same weakness: CWE-295
-
CVE-2026-10726
Cato Windows SDP Client arbitrary file disclosure due to imp -
CVE-2026-92868
Pgpool-II证书验证不当致认证绕过漏洞 -
CVE-2026-86131
Fireware OS Code Injection in BOVPN Over TLS Client Allows R -
CVE-2026-97687
urllib3: HTTPS proxy TLS configuration may be ignored or ove -
CVE-2026-73594
Dell SCG<5.36证书验证缺陷致信息泄露
V. Comments for CVE-2024-22030
No comments yet