What’s Vulnerable › Vulnerabilities
CVE-2026-104623: Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster
- Severity: medium (CVSS 6.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-30 · updated 2026-10-30
- Weakness: CWE-290
Description
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.
Affected products
- SUSE Rancher: from 2.15.0 before 2.15.3; from 2.14.0 before 2.14.7; from 2.13.0 before 2.13.11; from 2.12.0 before 2.12.15; from 2.11.0 before 2.11.19 — fixed in 2.15.3, 2.14.7, 2.13.11, 2.12.15, 2.11.19
How to fix
Upgrade to a fixed version: SUSE Rancher 2.15.3, 2.14.7, 2.13.11, 2.12.15. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-104623 or the next vulnerability affects your stack