TI-2022-13280 Aliases CVE-2022-31247 GHSA-6x34-89p7-95wg

Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

MEDIUM 41CWE-285Published 2022-09-07 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as cluster-owner, manage cluster members, project-owner and manage project members) to gain owner permission in another project in the same cluster or in another project on a different downstream cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.6.7; Rancher versions prior to 2.5.16.

Why it matters now

EPSS 0.01 63rd percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed Rancher (SUSE): 2.6.7, 2.5.16github.com/rancher/rancher (Go): 2.5.16, 2.6.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SUSE	Rancher	Rancher to before 2.6.7	2.6.7	Patch available	CNA
SUSE	Rancher	Rancher to before 2.5.16	2.5.16	Patch available	CNA
—	github.com/rancher/rancher (Go)	2.5.0 to before 2.5.16	2.5.16	Patch available	GHSA-6x34-89p7-95wg
—	github.com/rancher/rancher (Go)	2.6.0 to before 2.6.7	2.6.7	Patch available	GHSA-6x34-89p7-95wg

Rancher VendorSUSE Affected Rancher to before 2.6.7 Fixed in 2.6.7 Patch available CNA
Rancher VendorSUSE Affected Rancher to before 2.5.16 Fixed in 2.5.16 Patch available CNA
github.com/rancher/rancher (Go) Vendor— Affected 2.5.0 to before 2.5.16 Fixed in 2.5.16 Patch available GHSA-6x34-89p7-95wg
github.com/rancher/rancher (Go) Vendor— Affected 2.6.0 to before 2.6.7 Fixed in 2.6.7 Patch available GHSA-6x34-89p7-95wg

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:suse:rancher::::::::	2.5.0 to before 2.5.16; 2.6.0 to before 2.6.7	Vulnerable	SUSE

cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.5.16; 2.6.0 to before 2.6.7 Vulnerable ·SUSE

Remediation

Fix · CNA Rancher (SUSE) Fixed in 2.6.7
Fix · CNA Rancher (SUSE) Fixed in 2.5.16
Fix · GHSA-6x34-89p7-95wg github.com/rancher/rancher (Go) Fixed in 2.5.16 Advisory →
Fix · GHSA-6x34-89p7-95wg github.com/rancher/rancher (Go) Fixed in 2.6.7 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-09-07
SUSE Rancher 2.5.16, 2.6.7
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io objectPriority MEDIUM 49
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-31247
2026-10-03 Alias added: GHSA-6x34-89p7-95wg

References

Exploit 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-31247

Other 1

https://github.com/rancher/rancher

TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
TI-2022-21489 Rancher: Non-random authentication token CVSS 3.1CRITICAL 9.8
TI-2019-08380 An issue was discovered that affects the following versions of Rancher: v2.0.0 through… CVSS 3.0CRITICAL 9.8
TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
TI-2022-21491 Rancher: Exposure of sensitive fields CVSS 3.1CRITICAL 9.9

See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences