Is CVE-2026-71404 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71404 being exploited in the wild.

How severe is CVE-2026-71404?

High severity, with a CVSS score of 8.7, published 3 September 2026.

Is there a fix for CVE-2026-71404?

A patch was published on 2026-08-18: Patch merged to v2.15 release branch (PR #56642) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71404 attacked?

It is attacked over the network.

Am I affected by CVE-2026-71404?

Check whether you run Suse Rancher. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71404: Rancher Manager GlobalRole controller privilege escalation

CVE-2026-71404 · Severity: high · CVSS 8.7 · Published 2026-09-03

Rancher Manager, a Kubernetes container management platform, contains a privilege escalation vulnerability in its role-based access control system. An attacker with GlobalRole creation permissions can manipulate annotations to point at existing ClusterRoles (such as cluster-admin) and overwrite their permissions, effectively revoking access for legitimate administrators. The damage persists even after the malicious GlobalRole is deleted, causing operational disruption and potential lockout of system administrators.

Technologies: Suse Rancher. Vendors: Suse.

Quick answers

Is CVE-2026-71404 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71404 being exploited in the wild.
How severe is CVE-2026-71404?: High severity, with a CVSS score of 8.7, published 3 September 2026.
Which products and versions are affected?: Rancher Manager before 2.15.1.
Is there a fix for CVE-2026-71404?: A patch was published on 2026-08-18: Patch merged to v2.15 release branch (PR #56642) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71404 attacked?: It is attacked over the network.
Am I affected by CVE-2026-71404?: Check whether you run Suse Rancher. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the GlobalRole controller, which derives the target ClusterRole name from a user-settable `authz.management.cattle.io/cr-name` annotation without verifying ownership of the target ClusterRole. An attacker with delegated GlobalRole create or update permissions can craft a malicious GlobalRole that points this annotation at any existing ClusterRole (including highly privileged ones like cluster-admin) and cause the controller to overwrite that ClusterRole's rules. The fix, implemented in version 2.15.1 and later, changes the controller to compute ClusterRole names deterministically instead of using user-supplied annotations, treating annotations as purely informational. The vulnerability requires existing permissions to create or update GlobalRoles (typically only held by administrators).

Affected products

Rancher Manager before 2.15.1

Timeline

2026-09-03: disclosed: CVE-2026-71404 published
2026-08-18: patched: Patch merged to v2.15 release branch (PR #56642)
2026-08-14: patched: Fix merged to main branch (PR #56593)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.