TI-2022-21493 Aliases CVE-2022-43759 GHSA-7m72-mh5r-6j3r

Rancher: Privilege escalation via promoted roles

MEDIUM 41CWE-269Published 2023-02-07 · Updated 2025-03-25

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation, Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269 and CWE-284.

Summary

A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00677 52nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Rancher (SUSE): 2.5.17, 2.6.10github.com/rancher/rancher (Go): 2.5.17, 2.6.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SUSE	Rancher	Rancher to before 2.5.17	2.5.17	Patch available	CNA
SUSE	Rancher	Rancher to before 2.6.10	2.6.10	Patch available	CNA
—	github.com/rancher/rancher (Go)	2.5.0 to before 2.5.17	2.5.17	Patch available	GHSA-7m72-mh5r-6j3r
—	github.com/rancher/rancher (Go)	2.6.0 to before 2.6.10	2.6.10	Patch available	GHSA-7m72-mh5r-6j3r

Rancher VendorSUSE Affected Rancher to before 2.5.17 Fixed in 2.5.17 Patch available CNA
Rancher VendorSUSE Affected Rancher to before 2.6.10 Fixed in 2.6.10 Patch available CNA
github.com/rancher/rancher (Go) Vendor— Affected 2.5.0 to before 2.5.17 Fixed in 2.5.17 Patch available GHSA-7m72-mh5r-6j3r
github.com/rancher/rancher (Go) Vendor— Affected 2.6.0 to before 2.6.10 Fixed in 2.6.10 Patch available GHSA-7m72-mh5r-6j3r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:suse:rancher::::::::	2.5.0 to before 2.5.17; 2.6.0 to before 2.6.10	Vulnerable	SUSE

cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.5.17; 2.6.0 to before 2.6.10 Vulnerable ·SUSE

Remediation

Fix · CNA Rancher (SUSE) Fixed in 2.5.17
Fix · CNA Rancher (SUSE) Fixed in 2.6.10
Fix · GHSA-7m72-mh5r-6j3r github.com/rancher/rancher (Go) Fixed in 2.5.17 Advisory →
Fix · GHSA-7m72-mh5r-6j3r github.com/rancher/rancher (Go) Fixed in 2.6.10 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-02-07
SUSE Rancher 2.5.17
4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2022-21491 Rancher: Exposure of sensitive fieldsPriority MEDIUM 44
- TI-2022-06315 Authenticated user can gain unauthorized shell pod and kubectl access in the local clusterPriority LOW 38
- TI-2022-21492 Rancher: Command injection in Git packagePriority LOW 37
Show all 4 records →
Release · 2023-02-07
SUSE Rancher 2.6.10
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2022-21489 Rancher: Non-random authentication tokenPriority MEDIUM 46
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-43759
2026-10-03 Alias added: GHSA-7m72-mh5r-6j3r

References

Exploit 1

https://bugzilla.suse.com/show_bug.cgi?id=1205293

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-43759

Other 2

TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
TI-2022-21489 Rancher: Non-random authentication token CVSS 3.1CRITICAL 9.8
TI-2019-08380 An issue was discovered that affects the following versions of Rancher: v2.0.0 through… CVSS 3.0CRITICAL 9.8
TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
TI-2022-21491 Rancher: Exposure of sensitive fields CVSS 3.1CRITICAL 9.9

See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences