Rancher Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade (CVE-2025-4947)

Vulnerability Overview Title: Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher Description: A vulnerability exists in Rancher's legacy Project RoleTemplate Binding (PRTB) controller. When the feature (default configuration) is disabled, removing the permission from a RoleTemplate does not trigger the cleanup of the affected ClusterRoleBinding and ClusterRole. Consequently, users retain the ability to modify the PSA enforcement level in project namespaces even after their privileges have been revoked. Scope Affected Versions: - - Severity: Medium (CVSS v3 base metrics: 4.9 / 10) Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None Remediation Patch Versions: - - Patch Details: - Updated the legacy PRTB controller to properly clean up obsolete PSA ClusterRoles and ClusterRoleBindings. - In , the function now invokes the cleanup path when permissions are no longer present. Workarounds For environments that cannot be upgraded immediately, administrators can mitigate the issue by manually identifying and deleting obsolete PSA ClusterRoles and ClusterRoleBindings. These resources were created in RoleTemplates that granted the permission following a downgrade. Additional Information CVE ID: CVE-2025-4947 Weakness: CWE-261 Discoverer: bugbunny.ai More Information Contact the SUSE Rancher Security Team for security-related inquiries. Open an issue in the Rancher repository. Verify the support matrix and product lifecycle.

Goal Reached Thanks to every supporter — we hit 100%!

Rancher Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade (CVE-2025-4947)

More from this source