CVE-2024-52284: SUSE Fleet Vulnerability Exposes Sensitive Helm Values in Plain Text

CVE-2024-52284, identified in SUSE Rancher’s Fleet, is a high-severity flaw that exposes sensitive Helm values stored in plain text within BundleDeployment resources, potentially allowing unauthorized disclosure of credentials and other secrets. The vulnerability analysis notes that Helm values are stored in plain text inside BundleDeployment, and that BundleDeployment is not configured for Kubernetes encryption at rest by default, increasing exposure risk.

According to the advisory, unauthorized users with GET or LIST permissions on BundleDeployment could access these values, and the exposure depends on the permissions of the leaked credentials across services.

SUSE has released patched Fleet versions to address the issue, introducing a mechanism to store Helm values in secrets: the git job now creates Kubernetes secrets for Helm values, the Fleet controller generates BundleDeployments with a Helm values secret per deployment, and the Fleet agent retrieves the values from the secret during deployment, with fixed versions including Fleet v0.14.0, v0.13.1, v0.12.6 and v0.11.10.

For those unable to upgrade immediately, the advisory suggests restricting exposure by adjusting Helm values file paths, for example excluding certain files.