CVE-2026-104623
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possibly older versions. The authorization check introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated user to run a pod on the management cluster.
Risk Assessment
Any authenticated user may gain the ability to run pods on the management cluster, potentially leading to privilege escalation and infrastructure takeover. This poses a serious threat to the integrity and confidentiality of the environment.
Recommendation
Upgrade SUSE Rancher Manager to a version containing the fix. Until then, restrict access to the management cluster shell feature and monitor for unusual pod creation.
Other vulnerabilities in SUSE Rancher Manager
See all- CVE-2026-88810High
A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagated permissions into namespaces of downstream clusters without privilege-escalation validation, potentially allowing a non-administrative user to gain excessive permissions.
- CVE-2026-88809High
In the SUSE Rancher Manager meta proxy endpoint (/meta/proxy), the allowlist decision was evaluated where it could not stop a request from being forwarded. A rejected destination was logged but the request was still handed to the proxy's transport.
- CVE-2026-88811Critical
Missing filtering in the SUSE Rancher Manager meta proxy could cause passed-in Rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, and 2.13.0 up to 2.13.11.
Original NVD description (English source)
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS