SUSE Rancher Manager (< 2.15.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/suse-rancher-manager--2.15.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 23:05:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSUSE Rancher Manager authorization bypass (CVE-2026-104623)https://feed.craftedsignal.io/briefs/2026-10-rancher-auth-bypass/Fri, 30 Oct 2026 23:05:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-rancher-auth-bypass/An authorization bypass vulnerability in SUSE Rancher Manager (CVE-2026-104623) allows authenticated users to spawn an unprivileged shell pod in the cattle-system namespace.CVE-2026-104623 is an authorization bypass vulnerability affecting the local-cluster-shell feature in SUSE Rancher Manager. Authenticated Rancher users, including those with minimal global roles and no cluster-level privileges, can bypass authorization checks by using non-standard URL request shapes. This allows the creation of an interactive shell pod (dashboard-shell-*) in the cattle-system namespace. The issue was addressed in version 2.15.3 by enforcing a SubjectAccessReview within the handler.

]]>lowadvisory