CVE-2023-32194: Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-16 · updated 2026-06-17
Weakness: CWE-269

Description

A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will receive * permissions for core namespaces. This can lead to someone being capable of accessing, creating, updating, or deleting a namespace in the project.

Affected products

Rancher: from 2.6.0 before 2.6.14; from 2.7.0 before 2.7.10; from 2.8.0 before 2.8.2 — fixed in 2.6.14, 2.7.10, 2.8.2

How to fix

Upgrade to a fixed version: Rancher 2.6.14, 2.7.10, 2.8.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-32194 or the next vulnerability affects your stack