This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Rancher fixes a high-severity vulnerability
Rancher fixes a high-severity vulnerability with versions 2.9.9, 2.10.5 and 2.11.1 [1].
An authenticated remote attacker with permission to create projects within a single cluster can, because the project name is used as a namespace regardless of the cluster, gain unauthorized access to a project with the same name in another cluster and escalate their privileges. If an immediate update to a fixed version is not possible, it is recommended to ensure that projects with the same name cannot be created across clusters and to check whether such a collision has already occurred. To check the local cluster, an administrator can run the command: "kubectl get projects -A -o=custom-columns='NAME:metadata.name' | sort | uniq -c" [1].
The vulnerability is present in product:
- *:Rancher;>=2.8.0,<2.9.9;>=2.10.0,<2.10.5;>=2.11.0,<2.11.1;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-22031 at cve.org, NVD
- CWE-706: Use of Incorrectly-Resolved Name or Reference at cwe.mitre.org
The vulnerability was publicly disclosed 25. 4. 2025.
By CESNET, z.s.p.o. Michaela Ručková on 30. 4. 2025.