---
id: CVE-2019-12274
aliases:
  - GHSA-gc62-j469-9gjm
  - GO-2023-1991
title: Rancher Privilege Escalation Vulnerability
summary: Rancher Privilege Escalation Vulnerability
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: rancher
product: github.com/rancher/rancher
ecosystem: go
affected:
  - 'github.com/rancher/rancher >= 2.0.0, < 2.2.4'
  - github.com/rancher/rancher < 1.6.27
patched:
  - github.com/rancher/rancher 2.2.4
  - github.com/rancher/rancher 1.6.27
published: '2022-05-24'
updated: '2026-07-10'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-gc62-j469-9gjm'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-12274'
  - url: >-
      https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466
tags:
  - osv
  - go
epss: 0.01143
epssPercentile: 0.65318
ingestedAt: '2026-07-11T18:57:04.536Z'
---

## Overview

In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.

## Affected packages

- `github.com/rancher/rancher >= 2.0.0, < 2.2.4`
- `github.com/rancher/rancher < 1.6.27`

## Remediation

Upgrade to a patched release:

- `github.com/rancher/rancher 2.2.4`
- `github.com/rancher/rancher 1.6.27`