CVE-2026-71404: Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole
A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable authz.management.cattle.io/cr-name annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as cluster-admin, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted.
This issue affects Rancher: before 2.15.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rancher Managerto a version that resolves this vulnerability.Fixed in 2.15.1 - Compensating control
If you cannot upgrade immediately, restrict creation/update of GlobalRole resources to trusted administrators only, since delegated users with create/update permission can set the `authz.management.cattle.io/cr-name` annotation to target an existing ClusterRole and overwrite its rules.
Event History
Frequently Asked Questions
Who can exploit this issue?
A user needs delegated permission to create or update GlobalRole resources. No other prerequisites are stated.
What is the practical impact of a successful exploit?
The attacker can set the cr-name annotation to an existing ClusterRole and cause its rules to be overwritten. Targeting cluster-admin can revoke permissions for every principal bound to that role, affecting integrity and availability.
Does deleting the malicious GlobalRole undo the damage?
No. The overwritten ClusterRole rules persist after the malicious GlobalRole is deleted.
Which Rancher versions are affected?
Rancher versions before 2.15.1 are affected.