CVE-2024-22031: Rancher privilege escalation via project name collision

CVE-2024-22031 · Severity: high · CVSS 8.5 · Published 2026-10-15

Rancher is a Kubernetes management platform that organizes resources into projects. A user with the ability to create projects can exploit a flaw where projects are identified by name alone across clusters: by creating a new project with the same name as an existing project in a different cluster, the attacker gains unauthorized access to the victim's project and all its resources, leading to privilege escalation.

Technologies: github.com/rancher/rancher (Go), Suse Rancher. Vendors: Go, Suse.

Quick answers

Is CVE-2024-22031 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-22031 being exploited in the wild.
How severe is CVE-2024-22031?
High severity, with a CVSS score of 8.5, published 15 October 2026.
Which products and versions are affected?
github.com/rancher/rancher (Go) SEMVER:introduced=0, SEMVER:introduced=2.8.0,fixed=2.9.9; Suse Rancher 2.9.0 before 2.9.9, 2.10.0 before 2.10.5, 2.11.0 before 2.11.1.
Is there a fix for CVE-2024-22031?
Yes. github.com/rancher/rancher (Go): upgrade to 2.9.9 or later. Until then: Ensure users are not permitted to create projects with the same object names across different clusters. Identify affected systems by running `kubectl get projects -A -o=custom-columns='NAME:metadata.name' | sort | uniq -c` on the local cluster; any project appearing more than once indicates a collision. Remediate by deleting and recreating affected projects to eliminate namespace collisions. Note: Rancher v2.8 does not receive a fix for this issue; upgrade to a patched version instead. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-22031 attacked?
It is attacked over the network.
Am I affected by CVE-2024-22031?
Check whether you run github.com/rancher/rancher (Go) or Suse Rancher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/rancher/rancher (Go): upgrade to 2.9.9 or later
    go get github.com/rancher/rancher@v2.9.9

Ensure users are not permitted to create projects with the same object names across different clusters. Identify affected systems by running `kubectl get projects -A -o=custom-columns='NAME:metadata.name' | sort | uniq -c` on the local cluster; any project appearing more than once indicates a collision. Remediate by deleting and recreating affected projects to eliminate namespace collisions. Note: Rancher v2.8 does not receive a fix for this issue; upgrade to a patched version instead.

Technical details

A privilege escalation vulnerability exists in Rancher's project namespace handling: the platform uses the project name as the Kubernetes namespace identifier for storing project resources (PRTBs and secrets) without ensuring uniqueness across clusters. An authenticated attacker with create-project permissions can craft a project with the same name as an existing project in another cluster, gaining control of the victim's project. The fix introduces a unique "backingNamespace" field to isolate projects across clusters.

Affected products

  • SUSE Rancher 2.9.0 before 2.9.9, 2.10.0 before 2.10.5, 2.11.0 before 2.11.1

Identifiers

  • CVE-2024-22031
  • GHSA-8h6m-wv39-239m
  • GO-2025-3647

Timeline

  • 2025-04-25: disclosed
  • 2024-10-15: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.