CVE-2026-71404: Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole
A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable authz.management.cattle.io/cr-name annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as cluster-admin, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted.
This issue affects Rancher: before 2.15.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rancher Managerto a version that resolves this vulnerability.Fixed in 2.15.1 - Compensating control
Ensure only trusted users can create or update GlobalRole objects with delegated permissions that allow GlobalRole create/update (specifically where a user has delegated GlobalRole create or update permission).
- Operational
After upgrading to Rancher Manager 2.15.1, audit for and remediate any ClusterRole rule changes caused by malicious use of the authz.management.cattle.io/cr-name annotation (the overwrite persists even after the malicious GlobalRole is deleted).
Event History
Frequently Asked Questions
Who can exploit this issue?
A user needs delegated permission to create or update GlobalRole resources. No other prerequisites are stated.
What is the practical impact of a successful exploit?
The attacker can set the cr-name annotation to an existing ClusterRole and cause its rules to be overwritten. Targeting cluster-admin can revoke permissions for every principal bound to that role, affecting integrity and availability.
Does deleting the malicious GlobalRole undo the damage?
No. The overwritten ClusterRole rules persist after the malicious GlobalRole is deleted.
Which Rancher versions are affected?
Rancher versions before 2.15.1 are affected.