# CVE-2024-22031: Rancher privilege escalation via project name collision

Source: https://junglewise.ai/threats/cve-2024-22031-rancher-users-who-can-create-projects-can-gain-access-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2024-22031 · Severity: high · CVSS 8.5 · Published 2026-10-15

Rancher is a Kubernetes management platform that organizes resources into projects. A user with the ability to create projects can exploit a flaw where projects are identified by name alone across clusters: by creating a new project with the same name as an existing project in a different cluster, the attacker gains unauthorized access to the victim's project and all its resources, leading to privilege escalation.

Technologies: [github.com/rancher/rancher (Go)](https://junglewise.ai/threats/technologies/github-com-rancher-rancher), [Suse Rancher](https://junglewise.ai/threats/technologies/rancher). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2024-22031 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-22031 being exploited in the wild.

**How severe is CVE-2024-22031?** High severity, with a CVSS score of 8.5, published 15 October 2026.

**Which products and versions are affected?** github.com/rancher/rancher (Go) SEMVER:introduced=0, SEMVER:introduced=2.8.0,fixed=2.9.9; Suse Rancher 2.9.0 before 2.9.9, 2.10.0 before 2.10.5, 2.11.0 before 2.11.1.

**Is there a fix for CVE-2024-22031?** Yes. github.com/rancher/rancher (Go): upgrade to 2.9.9 or later. Until then: Ensure users are not permitted to create projects with the same object names across different clusters. Identify affected systems by running `kubectl get projects -A -o=custom-columns='NAME:metadata.name' | sort | uniq -c` on the local cluster; any project appearing more than once indicates a collision. Remediate by deleting and recreating affected projects to eliminate namespace collisions. Note: Rancher v2.8 does not receive a fix for this issue; upgrade to a patched version instead. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-22031 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-22031?** Check whether you run github.com/rancher/rancher (Go) or Suse Rancher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rancher/rancher (Go): upgrade to 2.9.9 or later

  ```sh
  go get github.com/rancher/rancher@v2.9.9
  ```


Ensure users are not permitted to create projects with the same object names across different clusters. Identify affected systems by running `kubectl get projects -A -o=custom-columns='NAME:metadata.name' | sort | uniq -c` on the local cluster; any project appearing more than once indicates a collision. Remediate by deleting and recreating affected projects to eliminate namespace collisions. Note: Rancher v2.8 does not receive a fix for this issue; upgrade to a patched version instead.

## Technical details

A privilege escalation vulnerability exists in Rancher's project namespace handling: the platform uses the project name as the Kubernetes namespace identifier for storing project resources (PRTBs and secrets) without ensuring uniqueness across clusters. An authenticated attacker with create-project permissions can craft a project with the same name as an existing project in another cluster, gaining control of the victim's project. The fix introduces a unique "backingNamespace" field to isolate projects across clusters.

## Affected products

- SUSE Rancher 2.9.0 before 2.9.9, 2.10.0 before 2.10.5, 2.11.0 before 2.11.1

## Identifiers

- CVE-2024-22031
- GHSA-8h6m-wv39-239m
- GO-2025-3647

## Timeline

- 2025-04-25: disclosed
- 2024-10-15: advisory

## References

- [https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22031](https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22031)
- [https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m](https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m)

## Related threats

- [SUSE Rancher privilege escalation in GlobalRole RBAC](https://junglewise.ai/threats/cve-2026-88810-a-privilege-escalation-issue-was-discovered-in-rancher-manager-s)
- [SUSE Rancher Fleet privilege escalation in resource deployment](https://junglewise.ai/threats/cve-2026-88808-a-vulnerability-has-been-identified-within-rancher-manager-where)
- [SUSE Rancher session revocation bypass on logout](https://junglewise.ai/threats/cve-2026-88805-incorrect-credential-cleaning-on-logout-could-be-used-by-remote)
- [SUSE Rancher stored cross-site scripting in public UI settings](https://junglewise.ai/threats/cve-2026-88804-an-unauthenticated-update-of-public-ui-settings-could-be-used-by)
- [Rancher Manager access control bypass in Token API](https://junglewise.ai/threats/cve-2026-75035-rancher-manager-access-control-bypass-in-token-api)