BaseFortify

Publication date: 2025-10-29

Last updated on: 2025-10-30

Assigner: SUSE

Description

A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters. This only affects custom Global Roles that have a * on * in * rule for resources or have a * on * rule for non-resource URLs

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-29

Last Modified

2025-10-30

Generated

2026-07-06

AI Q&A

2025-10-29

EPSS Evaluated

2026-07-05

NVD

CVE-2023-32199

EUVD

EUVD-2023-36458

Affected Vendors & Products

Vendor	Product	Version / Range
rancher	rancher	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-281	The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Attack-Flow Graph

Executive Summary

This vulnerability in Rancher Manager allows a user to retain administrative access to clusters even after a custom GlobalRole with administrative permissions or its binding has been removed. It specifically affects custom GlobalRoles that have wildcard (*) rules for resources or non-resource URLs, meaning the removal of these roles does not properly revoke the user's access.

Impact Analysis

The vulnerability can lead to unauthorized continued access to clusters by users who should have had their administrative permissions revoked. This can result in potential unauthorized actions, data exposure, or changes within the clusters, posing security risks.

Hi! I’m here to help you understand CVE-2023-32199. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70