Rancher: Privilege escalation via promoted roles

CVE-2022-43759

Summary

An improper privilege management vulnerability in SUSE Rancher allows users with access to utilize the escalate verb on Pod Resource Template Blocks (PRTBs), enabling them to elevate permissions for any promoted resource across any cluster. This presents security risks as unauthorized users could gain higher-level access than intended, potentially compromising the integrity and confidentiality of the system. It is crucial for organizations using affected versions to apply the necessary updates to mitigate potential threats.

References