EUVD-2026-40297
GHSA-4j6x-2764-m8gh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management API (AV:N/AC:L), attacker must be a logged-in user (PR:L), no interaction; authorization bypass yields high control-plane confidentiality, integrity, and availability impact.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.
AnalysisAI
Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal access they should not hold, because the GitHub authentication provider incorrectly caches the result of team membership expansion. The flaw (CWE-303, CVSS 8.8) means a low-privileged GitHub-authenticated user can be granted access tied to other principals/teams, effectively bypassing intended authorization. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Rancher is a SUSE-maintained Kubernetes multi-cluster management platform that delegates authentication to external identity providers, one of which is GitHub. When a user logs in, Rancher expands their GitHub team memberships into a set of 'principals' used to make authorization decisions across managed clusters and projects. CWE-303 (incorrect implementation of an authentication algorithm) here manifests as faulty caching: the team-membership-expansion logic cached principal results in a way that returned them for the wrong user, so the access scope of one principal could be served to any logged-in user. The affected component is the GitHub auth provider in Rancher's authentication subsystem (cpe:2.3:a:suse:rancher), not Kubernetes RBAC itself.
RemediationAI
Vendor-released patch: upgrade Rancher to 2.13.6 (for the 2.13 line) or 2.14.2 (for the 2.14 line) as the primary fix; consult the SUSE/Rancher advisory at https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh for upgrade guidance. If immediate upgrade is not possible, a targeted compensating control is to disable or avoid the GitHub authentication provider (switch to an alternative IdP such as local auth, SAML, or OIDC), accepting the trade-off that GitHub-based single sign-on and team-mapped access will stop working for users. Additionally, audit current principal/team-to-role bindings and revoke any unexpected access grants that may have resulted from the caching flaw, and restrict who can authenticate to the Rancher server (network ACLs to the management UI/API) to shrink the pool of potential abusers until patched.
An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. Rated critical severity (CVSS 9
A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by cr
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, a
Command injection in Rancher Manager’s cluster import endpoint enables remote attackers to deploy malicious containers o
SAML assertion replay in Rancher's Assertion Consumer Service (ACS) handler lets a person-in-the-middle who captures a v
Privilege escalation in SUSE Rancher (Kubernetes management platform) allows a user holding the Project Owner role to im
Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. Rated
Cleartext registration token exposure in Rancher allows a low-privileged user to obtain perpetually valid cluster join t
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected
A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as oth
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today