SUSE Rancher Fleet lets ordinary users gain cluster-admin on the management cluster
Ordinary users on a Rancher management server can seize top admin rights!
Summary
A flaw in Fleet's agent management controller lets an authenticated Rancher user with only the default user global role gain cluster-admin on the Rancher management cluster. Fleet 0.13.0 up to 0.16.3 and possibly older versions are affected.
Affected when
- Fleet enabled in Rancher (default)
- Ordinary users allowed to create Fleet workspaces (default)
What to do
Update Fleet to 0.16.3, 0.15.8, 0.14.12 or 0.13.17 matching your line, and Rancher to v2.15.3, v2.14.7, v2.13.11 or v2.12.15 matching yours, together. If you cannot update, remove Fleet workspace creation from ordinary users.
Update to at least the version for your product:
- SUSE Rancher Fleet 0.16 0.16.3 or later
- SUSE Rancher Fleet 0.15 0.15.8 or later
- SUSE Rancher Fleet 0.14 0.14.12 or later
- SUSE Rancher Fleet 0.13 0.13.17 or later
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen