Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster
Impact
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.
Source excerpt · suseAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
SUSE · suse
Rancher
5 ranges
SUSE · suse
Rancher
Compare with this publisher’s ranges. This does not inspect your installation.
affected
2.15.0 → before 2.15.3
semver versions
2.14.0 → before 2.14.7
semver versions
2.13.0 → before 2.13.11
semver versions
2.12.0 → before 2.12.15
semver versions
2.11.0 → before 2.11.19
semver versions
Other versions: unaffected
Original source description
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-104623View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
suse · platform conditions
Any condition may hold
Any condition may hold
Vulnerable product
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*From (inclusive): 2.15.0
Before: 2.15.3
Vulnerable product
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*From (inclusive): 2.14.0
Before: 2.14.7
Vulnerable product
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*From (inclusive): 2.13.0
Before: 2.13.11
Vulnerable product
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*From (inclusive): 2.12.0
Before: 2.12.15
Vulnerable product
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*From (inclusive): 2.11.0
Before: 2.11.19
Original applicability statements
[
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.15.0",
"versionEndExcluding": "2.15.3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.14.0",
"versionEndExcluding": "2.14.7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.13.0",
"versionEndExcluding": "2.13.11"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.12.0",
"versionEndExcluding": "2.12.15"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.11.0",
"versionEndExcluding": "2.11.19"
}
]
}
]
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-104623
Observed 2026-10-30T18:17:20.445Z · upstream updated 2026-10-30T18:09:00.059Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T17:37:16.874402Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.