CVE-2026-104623
Description
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.
How to fix
- SUSE Rancher2.15.3, 2.14.7, 2.13.11, 2.12.15, 2.11.19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SUSE Rancher | 2.15.0 ≤ v < 2.15.3, 2.14.0 ≤ v < 2.14.7, 2.13.0 ≤ v < 2.13.11, 2.12.0 ≤ v < 2.12.15, 2.11.0 ≤ v < 2.11.19 | 2.15.3, 2.14.7, 2.13.11, 2.12.15, 2.11.19 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.