CVE-2026-104623

Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster

State: Published
Severity: 6.3 Medium
Published: Oct 30, 2026
Updated: Oct 30, 2026
Reserved: Oct 2, 2026

Read the record on cve.org

Description

A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	suse

Weaknesses

CWE-290 Authentication bypass by spoofing

Affected Products

Product	Versions
RancherSUSE	2.15.0 to before 2.15.3Affected 2.14.0 to before 2.14.7Affected 2.13.0 to before 2.13.11Affected 2.12.0 to before 2.12.15Affected 2.11.0 to before 2.11.19Affected

References

https://github.com/rancher/rancher/security/advisories/GHSA-8x6f-2v58-x6p7vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.