CVE-2026-71404
Received Received - Intake

Privilege Escalation in Rancher Manager via ClusterRole Overwrite

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: SUSE

Description
A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted. This issue affects Rancher: before 2.15.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-71404
EUVD
EUVD-2026-70504

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rancher rancher to 2.15.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

A flaw in Rancher Manager allows a user with GlobalRole create or update permissions to manipulate the GlobalRole controller by setting a malicious annotation. This annotation can point to any existing ClusterRole, such as cluster-admin, and overwrite its rules without verifying ownership. This effectively revokes permissions for all principals bound to the targeted ClusterRole.

Impact Analysis

If exploited, this vulnerability could allow an attacker to revoke critical permissions for administrators or other users by overwriting ClusterRole rules. This could lead to unauthorized access restrictions, loss of administrative control, or disruption of services relying on those permissions.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized privilege escalation or denial of access, potentially violating access control requirements in GDPR or HIPAA. Organizations using affected Rancher versions may face compliance violations if permissions are improperly modified.

Mitigation Strategies

Upgrade Rancher Manager to version 2.15.1 or later to address the flaw in the GlobalRole controller.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71404. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart