---
id: CVE-2023-32196
aliases:
  - GHSA-7h8m-pvw3-5gh4
  - CVE-2023-32197
  - GHSA-64jq-m7rq-768h
  - GO-2024-2929
  - GO-2024-3220
title: >-
  Rancher allows privilege escalation in Windows nodes due to Insecure Access
  Control Lists
summary: >-
  Rancher allows privilege escalation in Windows nodes due to Insecure Access
  Control Lists
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
vendor: rancher
product: github.com/rancher/rancher
ecosystem: go
affected:
  - 'github.com/rancher/rancher >= 2.7.0, < 2.8.9'
  - 'github.com/rancher/rancher >= 2.9.0, < 2.9.3'
patched:
  - github.com/rancher/rancher 2.8.9
  - github.com/rancher/rancher 2.9.3
published: '2024-10-25'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:19.385151243Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-7h8m-pvw3-5gh4'
references:
  - url: 'https://github.com/rancher/rancher/security/advisories/GHSA-64jq-m7rq-768h'
  - url: 'https://github.com/rancher/rancher/security/advisories/GHSA-7h8m-pvw3-5gh4'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-32197'
  - url: 'https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32197'
  - url: 'https://github.com/rancher/rancher'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-32196'
  - url: 'https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32196'
tags:
  - osv
  - go
epss: 0.00553
epssPercentile: 0.45085
ingestedAt: '2026-09-12T03:13:01.757Z'
---

## Overview

### Impact

A vulnerability has been identified whereby Rancher Manager deployments containing Windows nodes have weak Access Control Lists (ACL), allowing `BUILTIN\Users` or `NT AUTHORITY\Authenticated Users` to view or edit sensitive files which could lead to privilege escalation.

The affected files include binaries, scripts, configuration and log files:

```
C:\etc\rancher\wins\config
C:\var\lib\rancher\agent\rancher2_connection_info.json
C:\etc\rancher\rke2\config.yaml.d\50-rancher.yaml
C:\var\lib\rancher\agent\applied\*-*-applied.plan
C:\usr\local\bin\rke2
C:\var\lib\rancher\capr\idempotence\idempotent.sh
```

RKE2 nodes expand the list to include the files below:

```
C:\etc\rancher\node\password
C:\var\lib\rancher\rke2\agent\logs\kubelet.log
C:\var\lib\rancher\rke2\data\v1.**.**-rke2r*-windows-amd64-*\bin\*
C:\var\lib\rancher\rke2\bin\*
```

**This vulnerability is exclusive to deployments that contain Windows nodes. Linux-only environments are not affected by it.**

Please consult the associated [MITRE ATT&CK - Technique - Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068/) for further information about this category of attack.

### Patches

Patched versions include Rancher Manager `2.8.9` and `2.9.3`. For RKE2 Windows nodes, please refer to its [specific advisory](https://github.com/rancher/rke2/security/advisories/GHSA-x7xj-jvwp-97rv). No patches are available for 2.7, therefore users are urged to upgrade to newer minor versions or to apply the manual workaround below.


### Workarounds

Users are advised to upgrade to a patched version of Rancher Manager. When that is not possible, users can enforce stricter ACLs for all sensitive files affected by this Security Advisory running [this](https://github.com/rancherlabs/support-tools/blob/master/windows-access-control-lists/README.md) PowerShell script as an Administrator on each node.


### References

- [CVE-2023-32197](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32197)
- [RKE2’s GHSA-x7xj-jvwp-97rv](https://github.com/rancher/rke2/security/advisories/GHSA-x7xj-jvwp-97rv)

### For more information

If you have any questions or comments about this advisory:
- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).

## Affected packages

- `github.com/rancher/rancher >= 2.7.0, < 2.8.9`
- `github.com/rancher/rancher >= 2.9.0, < 2.9.3`

## Remediation

Upgrade to a patched release:

- `github.com/rancher/rancher 2.8.9`
- `github.com/rancher/rancher 2.9.3`