SUSE Rancher up to 2.15.0 GlobalRole controller authz.management.cattle.io/cr-name privileges management

Summaryinfo

A vulnerability categorized as problematic has been discovered in SUSE Rancher up to 2.15.0. The affected element is the function GlobalRole controller. The manipulation of the argument authz.management.cattle.io/cr-name results in privileges management. This vulnerability was named CVE-2026-71404. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic has been found in SUSE Rancher up to 2.15.0. Affected is the function GlobalRole controller. The manipulation of the argument authz.management.cattle.io/cr-name with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on integrity, and availability. CVE summarizes:

A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted. This issue affects Rancher: before 2.15.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-71404 since 08/06/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Additional levels of successful authentication are necessary for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/03/2026). The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 2.15.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• SUSE

Name

• Rancher

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15.0

License

• open-source

Website

• Vendor: https://www.suse.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion