Authorization Bypass Vulnerability in SUSE Rancher Manager
CVE-2026-104623

6.3MEDIUM

Key Information:

Vendor

Suse
Status
Rancher
Vendor
CVE Published:
30 October 2026

What is CVE-2026-104623?

An authorization bypass vulnerability exists in the local management cluster shell feature of SUSE Rancher Manager. The security check intended to safeguard this feature was not comprehensively implemented across all API routes, allowing authenticated users to potentially execute unauthorized commands, such as launching a pod within the management cluster. Affected versions include SUSE Rancher Manager 2.15.0 through 2.15.3, among other earlier releases.

Affected Version(s)

Rancher 2.15.0 < 2.15.3

Rancher 2.14.0 < 2.14.7

Rancher 2.13.0 < 2.13.11

References

https://github.com/rancher/rancher/security/advisories/GH...
vendor-advisory

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

arpitjain099@gmail.com
.