CVE-2023-32194: Rancher

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will receive * permissions for core namespaces. This can lead to someone being capable of accessing, creating, updating, or deleting a namespace in the project.

Affected products

• Rancher Rancher: from 2.6.0, before 2.6.14 (fixed in 2.6.14); from 2.7.0, before 2.7.10 (fixed in 2.7.10); from 2.8.0, before 2.8.2 (fixed in 2.8.2)
• Suse Rancher: from 2.6.0, before 2.6.14 (fixed in 2.6.14); from 2.7.0, before 2.7.10 (fixed in 2.7.10); from 2.8.0, before 2.8.2 (fixed in 2.8.2)

Published 2024-10-16. Last modified 2026-06-17.