cnvd-2022-65017

EUVD-2026-180840

fkie_cve-2021-36776

A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users. This issue affects: SUSE Rancher Rancher versions prior to 2.5.10.

GHSA-gvh9-xgrq-r8hw — Rancher's Steve API Component Improper authorization check allows privilege escalation

Affected: Go: github.com/rancher/rancher

### Impact

A flaw discovered in Rancher versions from 2.5.0 up to and including 2.5.9 allows an authenticated user to impersonate any user on a cluster through the Steve API proxy, without requiring knowledge of the impersonated user's credentials. This is due to the Steve API proxy not dropping the impersonation header before sending the request to the Kubernetes API. A malicious user with authenticated access to Rancher could use this to impersonate another user with administrator access in Rancher, receiving, then, administrator level access in the cluster.

### Patches Patched versions include releases 2.5.10, 2.6.0 and later versions.

### Workarounds Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.

### For more information If you have any questions or comments about this advisory: * Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries. * Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository. * Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).

Most recent entries from all

cnvd-2022-65017

EUVD-2026-180840

fkie_cve-2021-36776

GHSA-gvh9-xgrq-r8hw — Rancher's Steve API Component Improper authorization check allows privilege escalation

gsd-2021-36776