CyberRota Analysis
AI-GeneratedA privilege escalation vulnerability in Rancher's impersonation middleware allows authenticated users with the default global role to gain full administrative access to the Rancher control plane and all downstream clusters it manages. This critical flaw, affecting multiple versions of Rancher, poses a significant risk to organizations relying on this platform for container management. Users and administrators of affected Rancher versions should prioritize applying the necessary updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.