Executive brief
Rancher is a popular platform for managing Kubernetes clusters. A flaw in how it handles user permissions means that when an administrator tries to revoke a user's ability to change security settings (Pod Security Admissions), those permissions may fail to actually be removed. This allows a user to maintain unauthorized control over security policies within a project even after their access was supposedly restricted.
Technical details
A vulnerability exists in the legacy Project Role Template Binding (PRTB) reconciler in Rancher (specifically when the 'aggregated-roletemplates' feature flag is disabled). The root cause is a missing clean-up path in the 'ensurePSAPermissions()' function within 'pkg/controllers/managementuser/rbac/prtb_handler.go'. When an administrator removes the 'updatepsa' permission from a RoleTemplate, the reconciler fails to delete the associated PSA ClusterRole and ClusterRoleBinding. An attacker with high privileges (already possessing the initial permission) can exploit this to retain persistent, unauthorized access to modify PSA enforcement levels across project namespaces. The issue is fixed in Rancher versions 2.14.3 and 2.13.7.
Affected products
- SUSE Rancher 2.13.0 to 2.13.6, 2.14.0 to 2.14.2
Timeline
- 2026-06-29: advisory: GitHub advisory published by Rancher team
- 2026-06-30: disclosed: NVD publication date