Rancher Privilege Escalation from Project Owner to Host (SUSE Rancher)
En bref
- Source
- NVD
- EPSS
- EPSS 0.42 % · centile 37 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- suse
- Statut NVD
- Analyzed
Description
Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.
Faiblesses (CWE)
- CWE-305 — Contournement d'authentification par faiblesse primaire
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | CRITICAL 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | suse |
| CVSS 4.0 | CRITICAL 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · meissner@suse.de (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-vx8h-4prv-g744 — Rancher has Privilege Escalation from Project Owner to Host
- GO-2026-5876 — Rancher has Privilege Escalation from Project Owner to Host in github.com/rancher/rancher
Références européennes
- ENISA EUVD · EUVD-2026-40130
- GCVE · GCVE-0-2026-41052
Configurations affectées (CPE NVD)
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*≥ 2.12.0 < 2.12.10cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*≥ 2.13.0 < 2.13.6cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*≥ 2.14.0 < 2.14.2
Produits affectés
| Produit | Versions |
|---|---|
| SUSE · Rancher | affected 2.12.0 < 2.12.10 ; affected 2.13.0 < 2.13.6 ; affected 2.14.0 < 2.14.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |