CVE-2024-22031— Rancher users who can create Projects can gain access to arbitrary projects
Quick assessment
Affected
SUSE rancher
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Rancher 中存在一个漏洞，允许在特定集群上具有创建项目权限的用户，创建与另一个集群中现有项目同名的项目。这会导致该用户获得对另一个集群中对应项目的访问权限，从而引发权限提升。该问题的根本原因在于，本地集群中用于存储相关资源（如项目角色绑定 PRTB 和密钥）的命名空间直接使用项目名称，导致命名空间冲突时发生权限绕过。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-22031
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rancher users who can create Projects can gain access to arbitrary projects
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2024-22031
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-22031
请登录查看更多情报信息。
Other References for CVE-2024-22031 (2)
Same Patch Batch · SUSE · 2026-10-15 · 5 CVEs total
| CVE-2023-32198 | 8.0 HIGH | Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) |
| CVE-2025-23390 | 6.3 MEDIUM | Fleet doesn’t validate a server’s certificate when connecting through SSH |
| CVE-2026-104618 | 6.2 MEDIUM | sdbootutil: world-readable debug log |
| CVE-2026-104617 | 5.1 MEDIUM | sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline |
IV. Related Vulnerabilities
Same product: rancher
-
CVE-2026-88804
Unauthenticated update of public UI settings leading to stor -
CVE-2026-88805
Session Not Revoked Server-Side on Logout in Rancher -
CVE-2026-88808
Fleet agent copies downstream resources with cluster-admin p -
CVE-2026-93540
Fleet applies namespace labels and annotations without the b -
CVE-2026-93539
Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook
Same vendor: SUSE
-
CVE-2026-104618
sdbootutil: world-readable debug log -
CVE-2026-104617
sdbootutil: qrencode invocation leaks PIN/recovery key in /p -
CVE-2023-32198
Steve doesn’t verify a server’s certificate and is susceptib -
CVE-2025-23390
Fleet doesn’t validate a server’s certificate when connectin -
CVE-2026-88804
Unauthenticated update of public UI settings leading to stor
Same weakness: CWE-863
-
CVE-2026-111369
ClassroomIO through 1.0.0 Incorrect Authorization via Lesson -
CVE-2026-111352
ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST -
CVE-2026-111332
OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Sha -
CVE-2026-45165
Idira Secrets Manager (Self-Hosted): Improper Authorization -
CVE-2026-111231
Netgate pfSense CE through 2.9.0 Authorization Bypass via co
V. Comments for CVE-2024-22031
No comments yet