CVE-2024-22031
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2024
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Rancher users who can create Projects can gain access to arbitrary projects
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
rancher
- Vendor
- SUSE
- Product
- rancher
- Platforms
- Unknown
- Default status
unaffected- Package
- github.com/rancher/rancher
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.8.0 | affected | semver | 2.9.9 | Unavailable | None listed |
| 2.10.0 | affected | semver | 2.10.5 | Unavailable | None listed |
| 2.11.0 | affected | semver | 2.11.1 | Unavailable | None listed |