Skip to content
Heist/ feed
Back to feed
High

Exposure of vSphere's CPI and CSI credentials in Rancher

Type: advisorySources: OSV

A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2022-45157
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 01:30 UTC · Revision 1

Source evidence

Exposure of vSphere's CPI and CSI credentials in Rancher

core-osv · Original source

Published 13 Nov 2024, 13:39 UTC

A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.

osv:CVE-2022-45157
Complete source record
{
  "id": "aa2c40868e0cac225e55f6472612655ad178d8c5a425f6d1a8eef898b6ef3e76",
  "url": "https://osv.dev/vulnerability/CVE-2022-45157",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Exposure of vSphere's CPI and CSI credentials in Rancher",
    "summary": "A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.",
    "evidence": "osv:CVE-2022-45157",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2022-45157",
      "aliases": [
        "CVE-2022-45157",
        "GHSA-xj7w-r753-vj8v",
        "GO-2024-3223"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/rancher/rancher",
              "type": "GIT",
              "events": [
                {
                  "introduced": "9e0cc54e7e3a924cf0ed5c5d4db0a6e53805c75e"
                },
                {
                  "fixed": "261bb3c70eeba7b6367a9924c9c2d0a3433f27c2"
                },
                {
                  "introduced": "ce9a7aea4b13fed7acd02cc32667b2ae72f98f5a"
                },
                {
                  "fixed": "d619f78675f4f071554afeb97716fb2090e895d7"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "2.9.0"
                      },
                      {
                        "fixed": "2.9.3"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "2.7.0"
                      },
                      {
                        "fixed": "2.8.9"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.8.6-alpha6",
            "v2.8.6",
            "v2.9.3-rc2",
            "v2.8.9-rc2",
            "v2.8.9-rc1",
            "v2.9.3-rc1",
            "v2.9.3-alpha7",
            "v2.9.3-alpha6",
            "v2.9.3-alpha5",
            "v2.8.9-alpha10",
            "v2.9.3-alpha4",
            "v2.8.9-alpha9",
            "v2.8.9-alpha8",
            "v2.9.3-alpha3",
            "v2.9.3-alpha2",
            "v2.9.3-alpha1",
            "v2.8.9-alpha6",
            "v2.8.9-alpha5",
            "v2.8.9-alpha4",
            "v2.8.9-alpha3",
            "v2.8.9-alpha2",
            "v2.8.9-alpha1",
            "v2.9.2",
            "v2.8.8",
            "v2.9.2-rc1",
            "v2.8.8-rc1",
            "v2.9.2-alpha7",
            "v2.9.2-alpha6",
            "v2.8.8-alpha2",
            "v2.9.2-alpha5",
            "v2.9.2-alpha4",
            "v2.9.2-alpha3",
            "v2.8.8-alpha1",
            "v2.9.2-alpha2",
            "v2.9.2-alpha1",
            "v2.8.7-rc10",
            "v2.8.7",
            "v2.9.1",
            "v2.9.1-rc6",
            "v2.8.7-rc9",
            "v2.9.1-rc5",
            "v2.9.1-rc4",
            "v2.8.7-rc8",
            "v2.8.7-rc7",
            "v2.9.1-alpha2",
            "v2.8.7-rc6",
            "v2.9.1-rc3",
            "v2.8.7-rc5",
            "v2.8.7-rc4",
            "v2.8.7-rc3",
            "v2.9.1-rc2",
            "v2.9.1-rc1",
            "v2.8.7-rc2",
            "v2.8.7-rc1",
            "v2.9.1-alpha1",
            "v2.9.0-rc6",
            "v2.9.0",
            "v2.8.6-alpha5",
            "v2.8.6-rc4",
            "v2.8.6-rc3",
            "v2.8.6-rc2",
            "v2.8.6-rc1",
            "v2.8.6-alpha4",
            "v2.8.6-alpha3",
            "v2.8.6-alpha2",
            "v2.8.4-rc5",
            "v2.8.4",
            "v2.8.6-alpha1",
            "v2.8.3-rc8",
            "v2.8.3",
            "v2.8.4-rc4",
            "v2.8.4-rc3",
            "v2.8.4-rc2",
            "v2.8.4-rc1",
            "v2.8.4-alpha1",
            "v2.8.3-rc7",
            "v2.8.3-rc6",
            "v2.8.3-rc5",
            "v2.8.3-rc4",
            "v2.8.3-rc3",
            "v2.8.3-rc2",
            "v2.8.3-rc1",
            "v2.8.3-alpha2",
            "v2.8.3-alpha1",
            "v2.7.5",
            "v2.8.0-rc5",
            "v2.8.0",
            "v2.8.0-rc4",
            "v2.8.0-rc3",
            "v2.8.0-rc2",
            "v2.8.0-rc1",
            "v2.8.0-alpha2",
            "v2.8.0-alpha1",
            "v2.7.7-rc2",
            "v2.7.7-rc1",
            "v2.7.5-rc6",
            "v2.7.5-rc5",
            "v2.7.5-rc4",
            "v2.7.5-rc3",
            "v2.7.5-rc2",
            "v2.7.5-rc1",
            "v2.7.2-rc9",
            "v2.7.2-rc10",
            "v2.7.2",
            "v2.7.2-rc8",
            "v2.7.2-rc7",
            "v2.7.2-rc6",
            "v2.7.2-rc5",
            "v2.7.2-rc4",
            "v2.7.2-rc3",
            "v2.7.2-rc2",
            "v2.7.0-novkdm",
            "v2.7.0",
            "v2.7.2-rc1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-45157.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.529587085Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45157.json",
        "https://github.com/rancher/rancher/security/advisories/GHSA-xj7w-r753-vj8v",
        "https://nvd.nist.gov/vuln/detail/CVE-2022-45157",
        "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2022-45157"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-522"
        ],
        "cna_assigner": "suse",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45157.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2022-45157",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499447,
  "published_at": "2024-11-13T13:39:10.338+00:00"
}