Executive brief
A security flaw in Rancher Manager's GitHub App authentication provider allows users to inherit permissions they were never granted. If a user belongs to just one team within a GitHub organization, Rancher may mistakenly grant them the access rights of every other team in that same organization. This could allow a low-privileged user to gain administrative control over clusters or access sensitive project data they should not be able to see.
Technical details
An incorrect implementation of the authentication algorithm (CWE-303) exists in Rancher's GitHub App authentication provider. When evaluating group principals, the logic incorrectly iterates over all teams in the associated GitHub organization instead of the user-specific membership list due to improper handling of cached data. An attacker with a valid GitHub account and membership in at least one team can bypass Role-Based Access Control (RBAC) and login allowlists. This allows the attacker to inherit permissions from any other team in the organization that has been mapped to Rancher roles. Patches are available in versions 2.14.2 and 2.13.6.
Affected products
- SUSE Rancher Manager >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6
Timeline
- 2026-05-27: disclosed
- 2026-06-30: advisory: NVD publication date
- 2026-07-01: advisory: GitHub Advisory reviewed