CVE-2026-88810 in Rancher
Summary
by MITRE • 11/02/2026
A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was not subject to the privilege-escalation validation applied to the other permission-carrying fields of a GlobalRole. As a result, a non-administrative user could be granted, through a global role binding, permissions in downstream clusters that exceed the permissions that user already holds. This affected SUSE Rancher 2.15.2 only, and SUSE Rancher Webhook 0.11.0 up to 0.11.4, and 0.12.0 up to 0.12.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
A critical privilege escalation vulnerability has been identified within the role-based access control mechanisms of SUSE Rancher Manager, specifically affecting versions 2.15.2 as well as SUSE Rancher Webhook components in ranges 0.11.0 through 0.11.4 and 0.12.0 through 0.12.1. This flaw stems from an inconsistency in how permissions are validated during the propagation of GlobalRole definitions to downstream clusters managed by the Rancher instance. In a typical Kubernetes-based environment, role bindings define what actions users or groups can perform within specific namespaces or across the entire cluster. The vulnerability centers on the inheritedNamespacedRules field of a GlobalRole, which is designed to automatically propagate permissions into named namespaces across all connected downstream clusters. While other permission-carrying fields in a GlobalRole are subjected to rigorous privilege-escalation validation checks to ensure that users cannot grant themselves more privileges than they currently possess or exceed administrative boundaries, the inheritedNamespacedRules field bypassed these safeguards entirely.
The technical root cause lies in the lack of enforcement for escalation constraints when processing namespace-specific rules within global roles. When a non-administrative user is bound to a GlobalRole containing such rules, the system incorrectly allows the assignment of permissions that exceed the scope of privileges already held by that user. This means an attacker with limited access could manipulate or exploit this misconfiguration to gain elevated rights in downstream clusters without triggering standard security alerts or validation failures. The absence of these checks creates a direct path for unauthorized privilege escalation, allowing low-privileged accounts to potentially execute administrative actions, modify cluster configurations, or access sensitive data across multiple namespaces and clusters under the management of the compromised Rancher instance.
From an operational impact perspective, this vulnerability poses significant risks to multi-cluster environments where centralized identity and access management is relied upon for security governance. An adversary who gains initial foothold as a non-administrative user could leverage this flaw to expand their attack surface dramatically. By escalating privileges in downstream clusters, the attacker may achieve lateral movement across the infrastructure, disrupt critical workloads, or exfiltrate sensitive information stored within those namespaces. The impact is particularly severe because it undermines the principle of least privilege, which is foundational to secure cluster operations. Organizations relying on Rancher for managing diverse Kubernetes environments face heightened exposure to internal threats and potential compliance violations due to this unchecked permission propagation mechanism.
This vulnerability aligns with CWE-269, Improper Privilege Management, as it involves a failure to properly restrict the execution of privileged functions or access control decisions based on user roles. Furthermore, in terms of attack tactics, it relates to MITRE ATT&CK technique T1078, Valid Accounts, specifically when combined with privilege escalation methods that allow attackers to maintain persistence and expand their influence within the environment by exploiting misconfigured role bindings rather than breaking out through traditional exploitation vectors. The flaw highlights a critical gap in validation logic during the synchronization of global policies into local cluster contexts.
To mitigate this risk, organizations running affected versions must immediately apply vendor-provided patches that address the validation oversight for inheritedNamespacedRules. It is essential to upgrade SUSE Rancher Manager and associated webhook components to versions where these privilege escalation checks are properly enforced. In addition to patching, administrators should audit existing GlobalRole bindings to identify any non-administrative users who may have been granted excessive permissions through this flawed mechanism. Implementing stricter monitoring for role binding changes and enforcing regular reviews of access controls can help detect unauthorized escalations early. Security teams should also consider implementing network segmentation and enhanced logging within downstream clusters to limit the blast radius in case a compromise occurs, ensuring that even if privilege escalation is attempted, its impact remains contained until full remediation is deployed.