Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2021-32001

K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token

Medium6.5EPSS 0.30%
Published
Updated
Reserved
Assigned by
suse

Description

K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions.

Scores

CVSS scores of CVE-2021-32001, by who scored it
Scored byCVSSScoreVector
suseCNA (assigner)3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Modified3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS (exploitation in 30 days)
0.30% · top 77% of all CVEs (5 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

Affected products

  • SUSE · Rancher

    • affected K3s – ≤ v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1

  • SUSE · Rancher

    • affected RKE2 – ≤ v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2021-32001 badge
[![CVE-2021-32001](https://trackcve.app/badge/CVE-2021-32001.svg)](https://trackcve.app/cve/CVE-2021-32001)

Record last updated .