Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

published 2022-09-07 4 y ago modified 2026-07-08 4 mo ago also GHSA-6x34-89p7-95wg , EUVD-2022-52825

cvss: 9.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits: 0; none known

An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as cluster-owner, manage cluster members, project-owner and manage project members) to gain owner permission in another project in the same cluster or in another project on a different downstream cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.6.7; Rancher versions prior to 2.5.16.

Patch / fix

fixed in 2

go github.com/rancher/rancher 2.5.16, 2.6.7
SUSE Rancher 2.5.16, 2.6.7

Exploit prediction

1.00% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

bugzilla.suse.com https://bugzilla.suse.com/show_bug.cgi?id=1199730 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/rancher/rancher/security/advisories/GHSA-6x34-89p7-95wg referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
GitHub	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
go	github.com/rancher/rancher	>=2.5.0, <2.5.16 >=2.6.0, <2.6.7	2.5.16 2.6.7

Affected products

SUSE Rancher

Classification

Weakness

CWE-285 Improper Authorization
CWE-863 Incorrect Authorization

References

bugzilla.suse.com /show_bug.cgi?id=1199730
web, exploit, issue-tracking, mitigation, vendor-advisory
github.com /rancher/rancher/security/advisories/GHSA-6x34-89p7-95wg
web, exploit, mitigation, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2022-31247
advisory
github.com /rancher/rancher
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary