CVE-2026-71404

published 2026-09-03

CVE-2026-71404: A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name`…

Priority P3 50 high 8.7 CVSS 3.1

AV N AC L PR H UI N S C C N I H A H

A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted.

This issue affects Rancher: before 2.15.1.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
suse	rancher	< 2.15.1	2.15.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-639