# CVE-2026-71404: Rancher Manager GlobalRole controller privilege escalation

Source: https://junglewise.ai/threats/cve-2026-71404-rancher-manager-globalrole-controller-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71404 · Severity: high · CVSS 8.7 · Published 2026-09-03

Rancher Manager, a Kubernetes container management platform, contains a privilege escalation vulnerability in its role-based access control system. An attacker with GlobalRole creation permissions can manipulate annotations to point at existing ClusterRoles (such as cluster-admin) and overwrite their permissions, effectively revoking access for legitimate administrators. The damage persists even after the malicious GlobalRole is deleted, causing operational disruption and potential lockout of system administrators.

Technologies: [Suse Rancher](https://junglewise.ai/threats/technologies/rancher). Vendors: [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-71404 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71404 being exploited in the wild.

**How severe is CVE-2026-71404?** High severity, with a CVSS score of 8.7, published 3 September 2026.

**Which products and versions are affected?** Rancher Manager before 2.15.1.

**Is there a fix for CVE-2026-71404?** A patch was published on 2026-08-18: Patch merged to v2.15 release branch (PR #56642) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71404 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-71404?** Check whether you run Suse Rancher. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the GlobalRole controller, which derives the target ClusterRole name from a user-settable `authz.management.cattle.io/cr-name` annotation without verifying ownership of the target ClusterRole. An attacker with delegated GlobalRole create or update permissions can craft a malicious GlobalRole that points this annotation at any existing ClusterRole (including highly privileged ones like cluster-admin) and cause the controller to overwrite that ClusterRole's rules. The fix, implemented in version 2.15.1 and later, changes the controller to compute ClusterRole names deterministically instead of using user-supplied annotations, treating annotations as purely informational. The vulnerability requires existing permissions to create or update GlobalRoles (typically only held by administrators).

## Affected products

- Rancher Manager before 2.15.1

## Timeline

- 2026-09-03: disclosed: CVE-2026-71404 published
- 2026-08-18: patched: Patch merged to v2.15 release branch (PR #56642)
- 2026-08-14: patched: Fix merged to main branch (PR #56593)

## References

- [https://github.com/rancher/rancher/pull/56593](https://github.com/rancher/rancher/pull/56593)
- [https://github.com/rancher/rancher/pull/56642](https://github.com/rancher/rancher/pull/56642)

## Related threats

- [SUSE Rancher privilege escalation in GlobalRole RBAC](https://junglewise.ai/threats/cve-2026-88810-a-privilege-escalation-issue-was-discovered-in-rancher-manager-s)
- [Rancher privilege escalation via project name collision](https://junglewise.ai/threats/cve-2024-22031-rancher-users-who-can-create-projects-can-gain-access-to)
- [SUSE Rancher Fleet privilege escalation in resource deployment](https://junglewise.ai/threats/cve-2026-88808-a-vulnerability-has-been-identified-within-rancher-manager-where)
- [SUSE Rancher session revocation bypass on logout](https://junglewise.ai/threats/cve-2026-88805-incorrect-credential-cleaning-on-logout-could-be-used-by-remote)
- [SUSE Rancher stored cross-site scripting in public UI settings](https://junglewise.ai/threats/cve-2026-88804-an-unauthenticated-update-of-public-ui-settings-could-be-used-by)