Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2023-32194

Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will receive * permissions for core namespaces. This can lead to someone being capable of accessing, creating, updating, or deleting a namespace in the project.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE rancher

Default version status: unaffected

  • 2.6.0 to < 2.6.14affected
  • 2.7.0 to < 2.7.10affected
  • 2.8.0 to < 2.8.2affected

References