Privilege Escalation in Rancher Manager by SUSE

CVE-2023-32199

What is CVE-2023-32199?

A security issue has been discovered in Rancher Manager, where users can still access clusters even after a custom GlobalRole providing administrative privileges is removed. This vulnerability arises specifically with Global Roles that employ wildcard rules for resource access, enabling unauthorized retention of cluster access, thereby compromising security integrity.

References