Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2023-32199: Rancher Manager allows unauthorized access after role removal
CVE-2023-32199 · published 1 year ago
Summary
A security issue in Rancher Manager can allow users to retain administrative access to clusters even after their custom role has been removed. This can happen if the custom role has a rule that allows access to all resources or all URLs. To fix this, review and update your custom roles to ensure they have specific rules and not blanket access.
What to do
- Update github.com rancher to version 0.0.0-20251014212116-7faa74a968c2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | rancher |
< 0.0.0-20251014212116-7faa74a968c2 Fix: upgrade to 0.0.0-20251014212116-7faa74a968c2
|
Original advisory text
A vulnerability has been identified within Rancher
Manager, where after removing a custom GlobalRole that gives
administrative access or the corresponding binding, the user still
retains access ...
A vulnerability has been identified within Rancher
Manager, where after removing a custom GlobalRole that gives
administrative access or the corresponding binding, the user still
retains access to clusters. This only affects custom Global Roles that have a * on * in * rule for resources or have a * on * rule for non-resource URLs
Manager, where after removing a custom GlobalRole that gives
administrative access or the corresponding binding, the user still
retains access to clusters. This only affects custom Global Roles that have a * on * in * rule for resources or have a * on * rule for non-resource URLs
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-281Improper Preservation of Permissions
Timeline
Published29 Oct 2025
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta