CVE-2026-104623 in Rancher
Summary
by MITRE • 10/30/2026
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in SUSE Rancher Manager versions 2.15.0 through 2.15.3, as well as earlier supported releases down to version 2.11.0, represents a critical flaw in the authorization logic governing the local management cluster shell feature. This component allows administrators and authorized users to execute commands directly within containers running on the Kubernetes control plane or infrastructure nodes of the managed clusters. The core issue stems from an incomplete implementation of access controls introduced to secure this high-privilege functionality. While specific API endpoints were correctly configured to enforce authentication and authorization checks, other alternative request paths leading to the same underlying shell handler bypassed these security mechanisms entirely. This inconsistency creates a significant gap in the defense-in-depth strategy employed by the platform, allowing attackers who possess valid credentials for any user account with cluster access to circumvent intended restrictions.
From a technical perspective, this flaw is classified as an authorization bypass vulnerability where the application fails to enforce consistent policy enforcement across all entry points that interact with sensitive resources. The shell feature typically requires elevated privileges because it provides direct command-line access to containerized environments, which can include nodes hosting critical control plane components such as etcd or kube-apiserver. By exploiting the unguarded API routes, an authenticated user can initiate a session that grants them interactive shell access without triggering the necessary role-based access control (RBAC) validations. This effectively elevates their permissions to those of a cluster administrator or even higher, depending on how the underlying container runtime is configured and what service accounts are mounted within the target pod.
The operational impact of this vulnerability is severe due to the nature of Kubernetes architecture. Once an attacker gains shell access via these unprotected routes, they can interact directly with the node's operating system if escape vectors exist or manipulate workloads running on that node. More critically, because this affects the management cluster itself, compromise here provides a foothold for lateral movement across all downstream managed clusters registered with Rancher. An adversary could exfiltrate sensitive data stored in secrets and configmaps, modify deployment configurations to establish persistence mechanisms such as backdoor containers or modified daemon sets, or disrupt service availability by deleting critical resources. The ability to run arbitrary pods on the management cluster also facilitates cryptomining operations, resource exhaustion attacks, or further exploitation of internal network services that are otherwise isolated from external threats.
This vulnerability aligns with CWE-284 Improper Access Control and specifically relates to insufficient verification of authorization before granting access to sensitive functions. In terms of offensive security frameworks, it maps directly to MITRE ATT&CK technique T1078 Valid Accounts, where an attacker uses legitimate credentials to gain initial access, followed by T1659 Cluster Management API Abuse if the shell is used to interact with Kubernetes APIs post-compromise. The lack of consistent enforcement across all API routes indicates a systemic design flaw rather than a simple coding error, suggesting that security testing and code review processes may have overlooked alternative request vectors or edge cases in the routing logic.
Mitigation strategies must prioritize immediate patching to the latest stable release of SUSE Rancher Manager where this authorization check has been comprehensively applied to all relevant API endpoints. Until patches are deployed, organizations should implement strict network segmentation policies that restrict access to the management cluster's API server from untrusted networks or user subnets. Additionally, enabling enhanced audit logging and monitoring for shell-related API calls can help detect anomalous activity indicative of exploitation attempts. It is also advisable to review RBAC roles assigned to users within Rancher environments to ensure principle of least privilege is strictly enforced, minimizing the blast radius should an account be compromised through this or other vectors. Regular security assessments focusing on authorization consistency across all application entry points are recommended to prevent similar oversights in future updates.