CVE-2026-104623

Full vulnerability record from the local CVENow database.

Description

A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.

Severity

MEDIUM

CVSS score

6.3 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-10-30 17:17:12.150000

Last modified

2026-10-30 17:44:35.820000

View original CVE JSON

{
  "id": "CVE-2026-104623",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-30T17:17:12.150",
  "lastModified": "2026-10-30T17:44:35.820",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "Rancher",
          "defaultStatus": "unaffected",
          "packageName": "Rancher",
          "repo": "https://github.com/rancher/rancher/",
          "versions": [
            {
              "version": "2.15.0",
              "lessThan": "2.15.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.14.0",
              "lessThan": "2.14.7",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.13.0",
              "lessThan": "2.13.11",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.12.0",
              "lessThan": "2.12.15",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.11.0",
              "lessThan": "2.11.19",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-8x6f-2v58-x6p7",
      "source": "[email protected]"
    }
  ]
}