Executive brief
Rancher Manager, a Kubernetes container management platform, contains a privilege escalation vulnerability in its role-based access control system. An attacker with GlobalRole creation permissions can manipulate annotations to point at existing ClusterRoles (such as cluster-admin) and overwrite their permissions, effectively revoking access for legitimate administrators. The damage persists even after the malicious GlobalRole is deleted, causing operational disruption and potential lockout of system administrators.
Technical details
The vulnerability exists in the GlobalRole controller, which derives the target ClusterRole name from a user-settable `authz.management.cattle.io/cr-name` annotation without verifying ownership of the target ClusterRole. An attacker with delegated GlobalRole create or update permissions can craft a malicious GlobalRole that points this annotation at any existing ClusterRole (including highly privileged ones like cluster-admin) and cause the controller to overwrite that ClusterRole's rules. The fix, implemented in version 2.15.1 and later, changes the controller to compute ClusterRole names deterministically instead of using user-supplied annotations, treating annotations as purely informational. The vulnerability requires existing permissions to create or update GlobalRoles (typically only held by administrators).
Affected products
- Rancher Manager before 2.15.1
Timeline
- 2026-09-03: disclosed: CVE-2026-71404 published
- 2026-08-18: patched: Patch merged to v2.15 release branch (PR #56642)
- 2026-08-14: patched: Fix merged to main branch (PR #56593)