SUSE Rancher Manager vulnerabilities

A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagated permissions into namespaces of downstream clusters without privilege-escalation validation, potentially allowing a non-administrative user to gain excessive permissions.

In the SUSE Rancher Manager meta proxy endpoint (/meta/proxy), the allowlist decision was evaluated where it could not stop a request from being forwarded. A rejected destination was logged but the request was still handed to the proxy's transport.

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed-in Rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, and 2.13.0 up to 2.13.11.

A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possibly older versions. The authorization check introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated user to run a pod on the management cluster.