https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T10:56:51.391943+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-71404 CVE-2026-71404 — Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole 2026-10-06T10:56:51.407778+00:00

Affected: SUSE Rancher

A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted.

This issue affects Rancher: before 2.15.1.