CVE-2022-31247: Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-07 · updated 2026-06-17
Weakness: CWE-285

Description

An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as cluster-owner, manage cluster members, project-owner and manage project members) to gain owner permission in another project in the same cluster or in another project on a different downstream cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.6.7; Rancher versions prior to 2.5.16.

Affected products

SUSE Rancher: from 2.5.0 before 2.5.16; from 2.6.0 before 2.6.7 — fixed in 2.5.16, 2.6.7

How to fix

Upgrade to a fixed version: SUSE Rancher 2.5.16, 2.6.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-31247 or the next vulnerability affects your stack