https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:50:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-39967 EUVD-2026-39967 https://cve.radiocsirt.org/vuln/euvd-2026-39967 https://cve.radiocsirt.org/vuln/fkie_cve-2020-10676 <p>In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move that namespace to a different project.</p> <p>In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move that namespace to a different project.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-10676 https://cve.radiocsirt.org/vuln/ghsa-8vhc-hwhc-cpj4 <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact A vulnerability was identified in which users with update privileges on a namespace, can move that namespace into a project they don&#39;t have access to. After the namespace transfer is completed, their previous permissions are still preserved, which enables them to gain access to project-specific resources (such as [project secrets](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-resources-setup/secrets#creating-secrets-in-projects)). In addition, resources in the namespace will now count toward the [quota limit](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/manage-projects/manage-project-resource-quotas/about-project-resource-quotas) of the new project, potentially causing availability issues.</p> <p>User with roles `Project Owner` and `Project Member` on the source project can exploit this vulnerability; however, this would also apply to custom roles with similar privileges.</p> <p>The patched version include an improved RBAC mechanism, which checks if the user has the correct permissions before the namespace move takes place.</p> <p>### Patches Patched versions include releases `2.6.13`, `2.7.4` and later versions.</p> <p>### Workarounds There is no direct mitigation besides updating Rancher to a patched version.</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquirie…</p> <p><strong>Affected:</strong> Go: github.com/rancher/rancher</p> <p>### Impact A vulnerability was identified in which users with update privileges on a namespace, can move that namespace into a project they don&#39;t have access to. After the namespace transfer is completed, their previous permissions are still preserved, which enables them to gain access to project-specific resources (such as [project secrets](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-resources-setup/secrets#creating-secrets-in-projects)). In addition, resources in the namespace will now count toward the [quota limit](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/manage-projects/manage-project-resource-quotas/about-project-resource-quotas) of the new project, potentially causing availability issues.</p> <p>User with roles `Project Owner` and `Project Member` on the source project can exploit this vulnerability; however, this would also apply to custom roles with similar privileges.</p> <p>The patched version include an improved RBAC mechanism, which checks if the user has the correct permissions before the namespace move takes place.</p> <p>### Patches Patched versions include releases `2.6.13`, `2.7.4` and later versions.</p> <p>### Workarounds There is no direct mitigation besides updating Rancher to a patched version.</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquirie…</p> https://cve.radiocsirt.org/vuln/ghsa-8vhc-hwhc-cpj4 https://cve.radiocsirt.org/vuln/gsd-2020-10676 gsd-2020-10676 https://cve.radiocsirt.org/vuln/gsd-2020-10676 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1340 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsvorkehrungen zu umgehen oder einen Cross Site Scripting angriff durchzuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsvorkehrungen zu umgehen oder einen Cross Site Scripting angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1340