A high-severity authorization bypass in Rancher Manager allows authenticated users to sabotage cluster permissions, leading to a total loss of access control.

This vulnerability is an authorization bypass (CWE-639) where the GlobalRole controller fails to verify ownership of ClusterRoles, allowing an authenticated user with delegated GlobalRole creation or update privileges to modify sensitive system roles.

Successful exploitation allows an attacker to effectively lock out administrators or escalate their own influence by stripping permissions from existing principals. Given the CVSS score of 8.7, this represents a significant risk to operational continuity and system integrity, as the malicious changes persist even after the initial trigger is removed.

Immediate Action: Upgrade all instances of Rancher to version 2.15.1 or later immediately to incorporate the necessary ownership verification logic.

Proactive Monitoring: Monitor Kubernetes audit logs for suspicious activity related to the authz.management.cattle.io/cr-name annotation and unauthorized modifications to critical ClusterRole objects.

Compensating Controls: Restrict GlobalRole create and update permissions to a minimal set of trusted users to reduce the attack surface until the patch can be applied.

Public Exploit Available: exploit_available (false)

The ability to manipulate core authorization roles poses a critical threat to the security posture of any Rancher-managed environment. Administrators should verify their current version and initiate the update process to version 2.15.1 without delay to prevent potential privilege revocation and unauthorized access control changes.