CVE-2022-31247: Suse Rancher

Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days.

An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as cluster-owner, manage cluster members, project-owner and manage project members) to gain owner permission in another project in the same cluster or in another project on a different downstream cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.6.7; Rancher versions prior to 2.5.16.

Affected products

• Suse Rancher: from 2.5.0, before 2.5.16 (fixed in 2.5.16); from 2.6.0, before 2.6.7 (fixed in 2.6.7)

Published 2022-09-07. Last modified 2026-06-17.