CVE-2019-12274

CVE-2019-12274 affects Rancher 1 and 2 up to 2.2.3. Unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane by posting data via node driver options, enabling reading of sensitive files such as /root/.kube/config or /var/lib/rancher/management-state/cr...