EUVD-2026-70504Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
PR:H reflects required delegated GlobalRole write permission; S:C because impact propagates into Kubernetes ClusterRoles outside the GlobalRole object; C:N as no data is disclosed.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable authz.management.cattle.io/cr-name annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as cluster-admin, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted.
This issue affects Rancher: before 2.15.1.
AnalysisAI
Privilege escalation in Rancher Manager before 2.15.1 allows any user with delegated GlobalRole create or update permission to permanently destroy cluster-wide Kubernetes RBAC policies by hijacking arbitrary ClusterRoles. The GlobalRole controller resolved its target ClusterRole by reading the user-settable authz.management.cattle.io/cr-name annotation rather than deriving the name from the GlobalRole's own identity, enabling an authenticated attacker to redirect the controller at any ClusterRole - including cluster-admin - and overwrite its rules. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker holds a Rancher account with explicitly delegated permission to create or update GlobalRole objects - this is a non-default administrative delegation that Rancher admins can grant to sub-administrators. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Rancher Manager to version 2.15.1 or later, which incorporates the changes from upstream PRs #56642 and #56593. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Rancher Manager deployments and confirm versions currently in use; temporarily restrict delegated GlobalRole create and update permissions to essential administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. Rated critical severity (CVSS 9
A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by cr
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, a
Command injection in Rancher Manager’s cluster import endpoint enables remote attackers to deploy malicious containers o
SAML assertion replay in Rancher's Assertion Consumer Service (ACS) handler lets a person-in-the-middle who captures a v
Privilege escalation in SUSE Rancher (Kubernetes management platform) allows a user holding the Project Owner role to im
Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. Rated
Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal
Cleartext registration token exposure in Rancher allows a low-privileged user to obtain perpetually valid cluster join t
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected
Vendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today