Description

A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted. This issue affects Rancher: before 2.15.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-09-03T15:17:32.327Z",
  "pubdate": "2026-09-03T15:17:32.327Z",
  "executiveSummary": "A critical authorization bypass and privilege management vulnerability exists in Rancher Manager, categorized as an improper access control flaw.\nThe vulnerability allows an authenticated user with delegated GlobalRole creation or update permissions to manipulate existing ClusterRole objects, including highly privileged ones like 'cluster-admin'.\nBy leveraging the 'authz.management.cattle.io/cr-name' annotation, an attacker can overwrite the rules of arbitrary ClusterRoles, effectively revoking permissions from legitimate principals bound to those roles, which leads to a denial of service or administrative lockout.\nThe malicious modification persists even after the deletion of the associated GlobalRole object, indicating a failure to implement proper reconciliation or state cleanup.\nThis flaw affects Rancher versions prior to 2.15.1 and presents a significant risk to the integrity of the cluster's authorization model, potentially allowing a low-privileged user to destabilize the security posture of the entire Rancher management layer.\nExploitation requires the attacker to possess sufficient permissions to manage GlobalRole resources within the Rancher environment.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of the 'authz.management.cattle.io/cr-name' annotation within the GlobalRole controller. When processing a GlobalRole resource, the controller fails to validate the ownership or the scope of the target ClusterRole identified by the user-provided annotation.\nThe controller assumes that the target ClusterRole is under its direct purview and proceeds to overwrite the existing rules of that object with rules defined in the GlobalRole. Because the system lacks an ownership check or a mechanism to prevent cross-resource manipulation, an attacker can designate critical system-level ClusterRoles, such as 'cluster-admin', as the target of this operation.\nThe attack flow proceeds as follows: First, the attacker creates or updates a malicious GlobalRole resource, injecting the target ClusterRole name into the 'authz.management.cattle.io/cr-name' annotation. Second, upon reconciliation, the GlobalRole controller reads the annotation and identifies the targeted, highly privileged ClusterRole. Third, the controller executes an update on the targeted ClusterRole, overwriting its existing ruleset with the potentially empty or restrictive rules specified in the malicious GlobalRole.\nThis action immediately affects all users, groups, and service accounts bound to the targeted ClusterRole, effectively revoking their permissions. The impact is significant because the state modification is permanent; deleting the malicious GlobalRole does not trigger an automatic rollback or restoration of the original rules for the affected ClusterRole, leaving the management layer in a compromised or inaccessible state.\nThe vulnerable component is the GlobalRole controller logic responsible for synchronizing resource states based on user-supplied metadata. Authentication is required to interact with the Rancher API to create or update GlobalRole resources. The exploit does not require direct network access to the underlying Kubernetes nodes but relies on the Rancher API's authorization enforcement, which fails to restrict the scope of the annotation-driven target selection.\nThis vulnerability effectively facilitates a privilege management bypass, enabling an attacker to perform administrative-level disruption and gain unauthorized control over the authorization environment."
}