SUSE Rancher Manager authorization bypass (CVE-2026-104623)
An authorization bypass vulnerability in SUSE Rancher Manager (CVE-2026-104623) allows authenticated users to spawn an unprivileged shell pod in the cattle-system namespace.
CVE search metadata
CVE search record: CVE-2026-104623. Severity: medium. CVSS: 6.3. KEV: no. Product: SUSE Rancher Manager (< 2.15.3). Brief: SUSE Rancher Manager authorization bypass (CVE-2026-104623). Brief link: https://feed.craftedsignal.io/briefs/2026-10-rancher-auth-bypass/
Triage facts
Revision 1- Applicability
- SUSE Rancher Manager (< 2.15.3)
- Evidence
- Not observed
- Severity
- Low
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 30, 23:05 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2026-104623 is an authorization bypass vulnerability affecting the local-cluster-shell feature in SUSE Rancher Manager. Authenticated Rancher users, including those with minimal global roles and no cluster-level privileges, can bypass authorization checks by using non-standard URL request shapes. This allows the creation of an interactive shell pod (dashboard-shell-*) in the cattle-system namespace. The issue was addressed in version 2.15.3 by enforcing a SubjectAccessReview within the handler.