CVE-2023-22648
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
An Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while logged into the Rancher UI. Users retain previous permissions even if their Azure AD group changes or they are removed from a group. Affects Rancher >= 2.6.7 < 2.6.13 and >= 2.7.0 < 2.7.4.
Risk Assessment
Users may retain access to Rancher despite revoked permissions in Azure AD, posing an access control risk. May lead to unauthorized access to resources.
Recommendation
Update Rancher to version 2.6.13 or later, or 2.7.4 or later.
Other vulnerabilities in SUSE Rancher
See all- CVE-2026-88804Critical
In SUSE Rancher (versions 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18), an unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting (XSS) attack in the Rancher UI.
- CVE-2023-22647Critical
An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted while read-level permissions were preserved. Followed by specially crafted commands, this could let a user gain access to tokens belonging to service accounts in the local cluster. Affects Rancher >= 2.6.0 < 2.6.13 and >= 2.7.0 < 2.7.4.
- CVE-2026-88805High
In SUSE Rancher 2.15 before 2.15.2, incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out, potentially leading to unauthorized access.
- CVE-2022-43760High
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to inject code that is executed within another user's browser, enabling theft of sensitive information, content manipulation, or other malicious activities on behalf of victims. This could let a user with write access to affected areas act on behalf of an administrator once the administrator opens the affected web page. The issue affects Rancher from >= 2.6.0 before < 2.6.13 and from >= 2.7.0 before < 2.7.4.
Original NVD description (English source)
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS