CVE-2026-104623 (GCVE-0-2026-104623)
Vulnerability from cvelistv5
Published
2026-10-30 16:11
Modified
2026-10-30 18:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-290 - Authentication bypass by spoofing
Summary
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104623",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:37:16.874402Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T18:09:00.059Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Rancher",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.3",
"status": "affected",
"version": "2.15.0",
"versionType": "semver"
},
{
"lessThan": "2.14.7",
"status": "affected",
"version": "2.14.0",
"versionType": "semver"
},
{
"lessThan": "2.13.11",
"status": "affected",
"version": "2.13.0",
"versionType": "semver"
},
{
"lessThan": "2.12.15",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
},
{
"lessThan": "2.11.19",
"status": "affected",
"version": "2.11.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.3",
"versionStartIncluding": "2.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.14.7",
"versionStartIncluding": "2.14.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.13.11",
"versionStartIncluding": "2.13.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.12.15",
"versionStartIncluding": "2.12.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.11.19",
"versionStartIncluding": "2.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "arpitjain099@gmail.com"
}
],
"datePublic": "2026-10-30T16:02:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of\u0026nbsp;SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster."
}
],
"value": "A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of\u00a0SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication bypass by spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:11:30.079Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-8x6f-2v58-x6p7"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-104623",
"datePublished": "2026-10-30T16:11:30.079Z",
"dateReserved": "2026-10-02T04:18:56.079Z",
"dateUpdated": "2026-10-30T18:09:00.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-104623\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-30T17:37:16.874402Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-30T18:02:05.907Z\"}}], \"cna\": {\"title\": \"Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"arpitjain099@gmail.com\"}], \"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115 Authentication Bypass\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/rancher/rancher/\", \"vendor\": \"SUSE\", \"product\": \"Rancher\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.15.0\", \"lessThan\": \"2.15.3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"2.14.0\", \"lessThan\": \"2.14.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"2.13.0\", \"lessThan\": \"2.13.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"2.12.0\", \"lessThan\": \"2.12.15\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"2.11.0\", \"lessThan\": \"2.11.19\", \"versionType\": \"semver\"}], \"packageName\": \"Rancher\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-10-30T16:02:00.000Z\", \"references\": [{\"url\": \"https://github.com/rancher/rancher/security/advisories/GHSA-8x6f-2v58-x6p7\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of\\u00a0SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of\u0026nbsp;SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-290\", \"description\": \"CWE-290 Authentication bypass by spoofing\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.15.3\", \"versionStartIncluding\": \"2.15.0\"}, {\"criteria\": \"cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.14.7\", \"versionStartIncluding\": \"2.14.0\"}, {\"criteria\": \"cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.13.11\", \"versionStartIncluding\": \"2.13.0\"}, {\"criteria\": \"cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.12.15\", \"versionStartIncluding\": \"2.12.0\"}, {\"criteria\": \"cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.11.19\", \"versionStartIncluding\": \"2.11.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"404e59f5-483d-4b8a-8e7a-e67604dd8afb\", \"shortName\": \"suse\", \"dateUpdated\": \"2026-10-30T16:11:30.079Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-104623\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-30T18:09:00.059Z\", \"dateReserved\": \"2026-10-02T04:18:56.079Z\", \"assignerOrgId\": \"404e59f5-483d-4b8a-8e7a-e67604dd8afb\", \"datePublished\": \"2026-10-30T16:11:30.079Z\", \"assignerShortName\": \"suse\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…