Aller au contenu
en Se connecter
8.5 Élevée

CVE-2024-22031 A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain…

Description

A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.

Produits et versions touchés

Produit Versions touchées Corrigé en
Rancher 2.11 2.11.0 → < 2.11.1 2.11.1
Rancher 2.10 2.10.0 → < 2.10.5 2.10.5
Rancher 2.8 2.8.0 → < 2.9.9 2.9.9

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Rancher

Les 86 CVE de Rancher →
CVE-2026-88811 Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud… 9.1 Critique CVE-2026-88810 A privilege escalation issue was discovered in Rancher Manager's role-based access control 7.2 Élevée CVE-2026-88809 A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy) 7.6 Élevée CVE-2026-94290 SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent… 9.1 Critique
Suivre cette CVE