# CVE-2026-104623: SUSE Rancher Manager authorization bypass in local cluster shell

Source: https://junglewise.ai/threats/cve-2026-104623-a-security-vulnerability-exists-in-the-authorization-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-104623 · Severity: medium · CVSS 6.3 · Published 2026-10-30

SUSE Rancher Manager is a Kubernetes orchestration platform used to manage multiple clusters across enterprises. A flaw in the authorization checks for the local management cluster shell feature allows any authenticated user to gain shell access to the management cluster's pods, even without explicit permission, bypassing isolation controls. This gives attackers compute resources and network access within the management plane that they should not have.

Technologies: [Suse Rancher Manager](https://junglewise.ai/threats/technologies/rancher-manager). Vendors: [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-104623 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104623 being exploited in the wild.

**How severe is CVE-2026-104623?** Medium severity, with a CVSS score of 6.3, published 30 October 2026.

**Which products and versions are affected?** Suse Rancher Manager 2.15.0-2.15.2, 2.14.0-2.14.6, 2.13.0-2.13.10, 2.12.0-2.12.14, 2.11.0-2.11.18, and earlier.

**Is there a fix for CVE-2026-104623?** Yes: fixed in Rancher Manager 2.15.3, 2.14.7, 2.13.11, 2.12.15, 2.11.19. Until then: Restrict the set of authenticated Rancher users to minimize exposure, place Rancher behind a reverse proxy or WAF that rejects shell endpoint requests from untrusted networks, and monitor the cattle-system namespace for unexpected dashboard-shell-* pods. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104623 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-104623?** Check whether you run Suse Rancher Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Rancher Manager 2.15.3, 2.14.7, 2.13.11, 2.12.15, 2.11.19

Restrict the set of authenticated Rancher users to minimize exposure, place Rancher behind a reverse proxy or WAF that rejects shell endpoint requests from untrusted networks, and monitor the cattle-system namespace for unexpected dashboard-shell-* pods.

## Technical details

The vulnerability is an authorization bypass in the local cluster shell endpoint caused by incomplete authorization checks across all API routes that reach the shell handler. An authenticated attacker can craft alternative request forms that skip the authorization check entirely, allowing them to create shell pods in the cattle-system namespace. The spawned pod runs as an unprivileged user with Kubernetes API access scoped to the attacker's identity, but breaks cluster isolation by granting unauthorized compute resources and network positioning on the management plane.

## Affected products

- SUSE Rancher Manager 2.15.0-2.15.2, 2.14.0-2.14.6, 2.13.0-2.13.10, 2.12.0-2.12.14, 2.11.0-2.11.18, and earlier

## Timeline

- 2026-10-29: disclosed
- 2026-10-29: patched

## References

- [https://github.com/rancher/rancher/security/advisories/GHSA-8x6f-2v58-x6p7](https://github.com/rancher/rancher/security/advisories/GHSA-8x6f-2v58-x6p7)

## Related threats

- [SUSE Rancher Manager credential leak in meta proxy](https://junglewise.ai/threats/cve-2026-88811-missing-filtering-in-the-suse-rancher-manager-meta-proxy-could)
- [SUSE Rancher Manager meta proxy allowlist bypass leading to SSRF](https://junglewise.ai/threats/cve-2026-88809-a-security-vulnerability-exists-in-the-suse-rancher-manager-meta)
- [Rancher Manager access control bypass in Token API](https://junglewise.ai/threats/cve-2026-75035-rancher-manager-access-control-bypass-in-token-api)
- [SUSE Rancher privilege escalation in GitHub App authentication provider](https://junglewise.ai/threats/cve-2026-41053-suse-rancher-privilege-escalation-in-github-app-authentication)