CVE-2024-58260— Rancher update on users can deny the service to the admin
Quick assessment
Affected
SUSE rancher
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Rancher是美国Rancher开源的一个开源容器管理平台，专为在生产环境中部署容器的组织而构建。 Rancher存在安全漏洞，该漏洞源于缺少服务器端验证，可能导致拒绝访问。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-58260
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rancher update on users can deny the service to the admin
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Rancher 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Rancher是美国Rancher开源的一个开源容器管理平台，专为在生产环境中部署容器的组织而构建。 Rancher存在安全漏洞，该漏洞源于缺少服务器端验证，可能导致拒绝访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-58260
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-58260
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-58260 (2)
Same Patch Batch · SUSE · 2025-10-02 · 3 CVEs total
| CVE-2024-58267 | 8.0 HIGH | Rancher CLI SAML authentication is vulnerable to phishing attacks |
| CVE-2025-54468 | 4.7 MEDIUM | Rancher sends sensitive information to external services through the `/meta/proxy` endpoin |
IV. Related Vulnerabilities
Same product: rancher
-
CVE-2026-44945
Cross-Cluster Impersonation Confused-Deputy Privilege Escala -
CVE-2026-55997
Long-lived Rancher registration token exposed in plaintext -
CVE-2026-55998
Cluster Existence Oracle via Unauthenticated Import Endpoint -
CVE-2026-59675
Rancher Audit-Log Middleware Unauthenticated Memory Exhausti -
CVE-2026-55996
Unauthenticated Denial-of-Service via TLS SAN Stuffing in Ra
Same vendor: SUSE
-
CVE-2026-44945
Cross-Cluster Impersonation Confused-Deputy Privilege Escala -
CVE-2026-25703
Potential information leakage from manager /network/graph AP -
CVE-2026-55998
Cluster Existence Oracle via Unauthenticated Import Endpoint -
CVE-2026-59675
Rancher Audit-Log Middleware Unauthenticated Memory Exhausti -
CVE-2026-55996
Unauthenticated Denial-of-Service via TLS SAN Stuffing in Ra
Same weakness: CWE-863
-
CVE-2026-62382
PasswordPusher before v2.9.6 Authentication Bypass via Null -
CVE-2026-60083
SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file -
CVE-2026-4245
Post Duplicator <= 3.0.11 - Authorization Bypass to Authenti -
CVE-2026-77234
Improper input validation in FreeRTOS-Kernel timer command h -
CVE-2026-62941
Incus: Cross-project instance copy bypasses target project r
V. Comments for CVE-2024-58260
No comments yet