Privilege Escalation in Rancher Product by Vendor

CVE-2024-22031

What is CVE-2024-22031?

A vulnerability exists within Rancher that allows a user with project creation rights on one cluster to duplicate the project name in another cluster. This flaw enables unauthorized access to resources of the other project due to the shared namespace used for storing related resources, such as PRTBs and secrets. This situation can lead to privilege escalation, posing significant security risks within multi-cluster environments.

References