SUSE Rancher: Improper RoleTemplate checks can enable privilege escalation

A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific scenarios can lead to privilege escalation.

The normalized record identifies SUSE Rancher, package github.com/rancher/rancher, with a default status of unaffected but explicitly lists these affected branches:

• 2.7 branch: affected from 2.7.0 and less than 2.7.14.
• 2.8 branch: affected from 2.8.0 and less than 2.8.5.

The advisory identifies 2.7.14 and 2.8.5 as patched releases. The status of parallel branches or other releases should not be inferred beyond these confirmed boundaries.

This is a CWE-269: Improper Privilege Management flaw in the webhook rule resolver. When external=true and the context is set to project or left empty, the resolver can ignore rules from the ClusterRole backing an external RoleTemplate. The fix adds an ExternalRules field to the RoleTemplate CRD so rules can be resolved directly from the RoleTemplate; when the field is not provided, rules from the backing ClusterRole are used. When ExternalRules is set, it takes precedence and becomes the source of truth for creating Rancher resources on the local cluster. The available evidence does not describe the exact request or payload, but it confirms network reachability, high privileges required, high attack complexity, and no user interaction. The change can also affect compatibility for external RoleTemplates with context set to project or left empty when the backing ClusterRole does not exist.

• The documented reachability is network.
• The attacker must already have high privileges; the record does not identify the exact account type or permission set.
• The attack is described as high complexity and does not require user interaction.
• The supplied record marks public exploit as false, but it does not establish real-world exploitation status or whether the flaw has been exploited in a particular environment.

The flaw can result in privilege escalation in Rancher when rules for an external RoleTemplate are not checked or resolved correctly. The resulting access may let an already privileged actor perform actions beyond the intended authorization boundary, potentially affecting the confidentiality, integrity, and availability of resources managed by Rancher. The supplied assessment describes the scope as unchanged, so the evidence does not show a required transition to an independent authority outside the affected component. The actual permissions obtained, data affected, and organizational scope depend on each RoleTemplate rule set and local-cluster configuration.

Successful exploitation could give an actor permissions beyond those intended by the RoleTemplate. Depending on the rules involved, the resulting access could allow reading data, modifying resources, or disrupting Rancher-managed resources. This may affect authorization boundaries between projects, clusters, and resources on the local cluster. The available evidence does not identify a breach, victim, or specific data scope, so the practical impact depends on the permissions assigned to the RoleTemplate and the Rancher configuration.

1. Upgrade the affected 2.7 branch to the release identified by the advisory as 2.7.14.
2. After upgrading on the 2.7 branch, enable the external-rules feature flag; the advisory requires this opt-in step for the fix to take effect.
3. For the 2.8 branch, upgrade to the release identified by the advisory as 2.8.5; the fix is applied automatically on this release line.
4. If an upgrade cannot be completed immediately, review external RoleTemplate objects with context set to project or left empty, no externalRules, and no backing ClusterRole. The advisory describes creating the ClusterRole referenced by these objects as a workaround for identified objects.
5. After making the change, recheck the RoleTemplate rules, the backing ClusterRole, and the feature-flag state before considering remediation complete.

• Inventory SUSE Rancher deployments and identify their running release, then compare them with the affected branches and patched releases listed in affected_summary.
• List RoleTemplate objects meeting all of these conditions: context is project or empty, external=true, externalRules is absent, and builtin=false.
• For each matching object, check whether a same-named backing ClusterRole exists.
• Prioritize matching objects without a backing ClusterRole, because the advisory identifies them as potentially affected and describes creating the backing ClusterRole as a corrective action.
• Not finding a matching object during one review does not prove that the environment is safe. Repeat the check after configuration changes or upgrades. Logs and authorization alerts can be reviewed as precautionary monitoring, not as confirmed indicators.