Vulnerability-Lookup

CVE-2024-22031 (GCVE-0-2024-22031)

Vulnerability from cvelistv5 – Published: 2026-10-15 08:21 – Updated: 2026-10-16 03:56

Title

Rancher users who can create Projects can gain access to arbitrary projects

Summary

A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.

Severity

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 00:00 UTC

CWE

CWE-863 - Incorrect authorization

Assigner

suse CNA under the mitre root

CNA scorecard B 80/100 over 118 records in the last 180 days details

References

2 references

URL	Tags
https://bugzilla.suse.com/show_bug.cgi?id=CVE-202…
https://github.com/rancher/rancher/security/advis…

Impacted products

1 product

Vendor	Product	Version	CPE status
SUSE	rancher	Affected: 2.8.0 , < 2.9.9 (semver) Affected: 2.10.0 , < 2.10.5 (semver) Affected: 2.11.0 , < 2.11.1 (semver)	guessed

Date Public

2025-04-25 15:09

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22031",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T03:56:35.364Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/rancher/rancher",
          "product": "rancher",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.9.9",
              "status": "affected",
              "version": "2.8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.10.5",
              "status": "affected",
              "version": "2.10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.11.1",
              "status": "affected",
              "version": "2.11.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2025-04-25T15:09:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.\u003c/p\u003e"
            }
          ],
          "value": "A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T08:21:02.222Z",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22031"
        },
        {
          "url": "https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Rancher users who can create Projects can gain access to arbitrary projects",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2024-22031",
    "datePublished": "2026-10-15T08:21:02.222Z",
    "dateReserved": "2024-01-04T12:38:34.023Z",
    "dateUpdated": "2026-10-16T03:56:35.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-22031",
      "date": "2026-11-01",
      "epss": "0.00435",
      "percentile": "0.37772"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageName": "github.com/rancher/rancher",
                "product": "rancher",
                "vendor": "SUSE",
                "versions": [
                  {
                    "lessThan": "2.9.9",
                    "status": "affected",
                    "version": "2.8.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.10.5",
                    "status": "affected",
                    "version": "2.10.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.11.1",
                    "status": "affected",
                    "version": "2.11.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "meissner@suse.de"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project."
          },
          {
            "lang": "es",
            "value": "Se ha identificado una vulnerabilidad en Rancher donde un usuario con la capacidad de crear un proyecto, en un determinado cl\u00faster, puede crear un proyecto con el mismo nombre que un proyecto existente en otro cl\u00faster. Esto permite que el usuario obtenga acceso al otro proyecto en el cl\u00faster diferente, provocando una escalada de privilegios. Esto ocurre porque el namespace utilizado en el cl\u00faster local para almacenar los recursos relacionados (PRTBs y secrets) es el nombre del proyecto."
          }
        ],
        "id": "CVE-2024-22031",
        "lastModified": "2026-10-27T19:10:00.123",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 6.0,
              "source": "meissner@suse.de",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-22031",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-15T09:17:14.023",
        "references": [
          {
            "source": "meissner@suse.de",
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22031"
          },
          {
            "source": "meissner@suse.de",
            "url": "https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m"
          }
        ],
        "sourceIdentifier": "meissner@suse.de",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "meissner@suse.de",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-22031",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-15T14:20:26.461755Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-15T14:20:48.595Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageName": "github.com/rancher/rancher",
              "product": "rancher",
              "vendor": "SUSE",
              "versions": [
                {
                  "lessThan": "2.9.9",
                  "status": "affected",
                  "version": "2.8.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "2.10.5",
                  "status": "affected",
                  "version": "2.10.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "2.11.1",
                  "status": "affected",
                  "version": "2.11.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "datePublic": "2025-04-25T15:09:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.\u003c/p\u003e"
                }
              ],
              "value": "A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-15T08:21:02.222Z",
            "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
            "shortName": "suse"
          },
          "references": [
            {
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22031"
            },
            {
              "url": "https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Rancher users who can create Projects can gain access to arbitrary projects",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "assignerShortName": "suse",
        "cveId": "CVE-2024-22031",
        "datePublished": "2026-10-15T08:21:02.222Z",
        "dateReserved": "2024-01-04T12:38:34.023Z",
        "dateUpdated": "2026-10-16T03:56:35.364Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2024-22031

Vulnerability from fkie_nvd - Published: 2026-10-15 09:17 - Updated: 2026-10-27 19:10

Severity

8.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	meissner@suse.de	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22031
	meissner@suse.de	https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/rancher/rancher",
          "product": "rancher",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.9.9",
              "status": "affected",
              "version": "2.8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.10.5",
              "status": "affected",
              "version": "2.10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.11.1",
              "status": "affected",
              "version": "2.11.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "meissner@suse.de"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en Rancher donde un usuario con la capacidad de crear un proyecto, en un determinado cl\u00faster, puede crear un proyecto con el mismo nombre que un proyecto existente en otro cl\u00faster. Esto permite que el usuario obtenga acceso al otro proyecto en el cl\u00faster diferente, provocando una escalada de privilegios. Esto ocurre porque el namespace utilizado en el cl\u00faster local para almacenar los recursos relacionados (PRTBs y secrets) es el nombre del proyecto."
    }
  ],
  "id": "CVE-2024-22031",
  "lastModified": "2026-10-27T19:10:00.123",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 6.0,
        "source": "meissner@suse.de",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22031",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-15T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-15T09:17:14.023",
  "references": [
    {
      "source": "meissner@suse.de",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22031"
    },
    {
      "source": "meissner@suse.de",
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m"
    }
  ],
  "sourceIdentifier": "meissner@suse.de",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "meissner@suse.de",
      "type": "Secondary"
    }
  ]
}

GHSA-8H6M-WV39-239M

Vulnerability from github – Published: 2025-04-25 15:09 – Updated: 2025-05-23 18:36

Summary

Rancher users who can create Projects can gain access to arbitrary projects

Details

Impact

Please consult the associated MITRE ATT&CK - Technique - Privilege Escalation for further information about this category of attack.

Patches

Patched versions include releases v2.11.1, v2.10.5, v2.9.9.

The fix involves the following changes:

Rancher: - Instead of using the project name as the namespace, Rancher will instead be using a new field on the project spec called backingNamespace. If that field exists, use that for the project namespace going forward. However, if the project does not have that field filled out (likely because it existed before this change), Rancher will continue using the name for the namespace.

Rancher Webhook: - New mutation on create project.Status.BackingNamespace to be SafeConcatName(project.Spec.ClusterName, project.Name); - Generate the name manually within the mutating webhook, because normally, name generation happens after the mutating webhooks; - Removed a validation where projectName and Namespace had to be the same for PRTBs, since PRTBs now go in project.BackingNamespace; - On update, if BackingNamespace isn't set, set it to project.Name. For existing objects after update this will help unify them to the new projects. - The BackingNamespace can't be edited after it's set.

Note: Rancher v2.8 release line does not have the fix for this CVE. The fix for v2.8 was considered too complex and with the risk of introducing instabilities right before this version goes into end-of-life (EOL), as documented in SUSE’s Product Support Lifecycle page. Please see the section below for workarounds or consider upgrading to a newer and patched version of Rancher.

Workarounds

If you can't upgrade to a fixed version, please make sure that: - Users are not allowed to create projects with the same object names from another cluster.

To identify if this security issue could have been abused within your system, you need to find if there are any projects with the same name but on different clusters. To do that, run the following command in the local cluster as an administrator:

kubectl get projects -A -o=custom-columns='NAME:metadata.name' | sort | uniq -c

That command will list all project names, and show the instances of each name. Any project with more than 1 instance is affected by this security issue. To remedy the situation, the projects will need to be deleted and re-created to ensure no namespace collisions happen. While it would be possible to delete all but 1 of the projects with the same name, this is unadvisable because a user could have given themselves access to the wrong project.

References

If you have any questions or comments about this advisory: - Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.

Severity

8.5 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.8.0"
            },
            {
              "fixed": "2.9.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.10.0"
            },
            {
              "fixed": "2.10.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.11.0"
            },
            {
              "fixed": "2.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-22031"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-25T15:09:26Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nA vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.\n\nPlease consult the associated  [MITRE ATT\u0026CK - Technique - Privilege Escalation](https://attack.mitre.org/tactics/TA0004/) for further information about this category of attack.\n\n### Patches\nPatched versions include releases `v2.11.1`, `v2.10.5`, `v2.9.9`.\n\nThe fix involves the following changes:\n\n**Rancher:**\n- Instead of using the project name as the namespace, Rancher will instead be using a new field on the project spec called backingNamespace. If that field exists, use that for the project namespace going forward. However, if the project does not have that field filled out (likely because it existed before this change), Rancher will continue using the name for the namespace.\n\n**Rancher Webhook:**\n- New mutation on create `project.Status.BackingNamespace` to be `SafeConcatName(project.Spec.ClusterName, project.Name)`;\n- Generate the name manually within the mutating webhook, because normally, name generation happens after the mutating webhooks;\n- Removed a validation where `projectName` and `Namespace` had to be the same for PRTBs, since PRTBs now go in `project.BackingNamespace`;\n- On update, if `BackingNamespace` isn\u0027t set, set it to `project.Name`. For existing objects after update this will help unify them to the new projects.\n- The `BackingNamespace` can\u0027t be edited after it\u0027s set.\n\n**Note: Rancher v2.8 release line does not have the fix for this CVE. The fix for v2.8 was considered too complex and with the risk of introducing instabilities right before this version goes into end-of-life (EOL), as documented in [SUSE\u2019s Product Support Lifecycle](https://www.suse.com/lifecycle/#suse-rancher-prime) page. Please see the section below for workarounds or consider upgrading to a newer and patched version of Rancher.**\n\n### Workarounds\nIf you can\u0027t upgrade to a fixed version, please make sure that:\n- Users are not allowed to create projects with the same object names from another cluster.\n\nTo identify if this security issue could have been abused within your system, you need to find if there are any projects with the same name but on different clusters. To do that, run the following command in the local cluster as an administrator:\n```\nkubectl get projects -A -o=custom-columns=\u0027NAME:metadata.name\u0027 | sort | uniq -c\n```\n\nThat command will list all project names, and show the instances of each name. Any project with more than 1 instance is affected by this security issue. To remedy the situation, the projects will need to be deleted and re-created to ensure no namespace collisions happen. While it would be possible to delete all but 1 of the projects with the same name, this is unadvisable because a user could have given themselves access to the wrong project.\n\n### References\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
  "id": "GHSA-8h6m-wv39-239m",
  "modified": "2025-05-23T18:36:19Z",
  "published": "2025-04-25T15:09:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/commit/7f16b596120dd382ce6e9ed0baf83bc23f633054"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/commit/9c1d1c2bfcba36ae4f06c1fd043eb539ad801d4d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/commit/b0be28f86fc556414bd9b323f05b2b4bf8317c2d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/commit/f036e8b6ab726c3abbc03bbf7c8d0d53373c84e5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rancher/rancher"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3647"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Rancher users who can create Projects can gain access to arbitrary projects"
}

GSD-2024-22031

Vulnerability from gsd - Updated: 2024-01-05 06:02

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2024-22031

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-22031"
      ],
      "id": "GSD-2024-22031",
      "modified": "2024-01-05T06:02:20.490103Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2024-22031",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

OPENSUSE-SU-2025:15059-1

Vulnerability from csaf_opensuse - Published: 2025-05-07 00:00 - Updated: 2026-10-18 10:26

Summary

govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media

Severity

Moderate

Scope

12 vulnerabilities in this advisory, including CVE-2024-22031.

CVE-2024-22031

Recommended: 4 products

Open the full advisory

WID-SEC-W-2025-0890

Vulnerability from csaf_certbund - Published: 2025-04-27 22:00 - Updated: 2025-04-27 22:00

Summary

Rancher: Schwachstelle ermöglicht Privilegieneskalation

Severity

Hoch

Scope

1 vulnerability in this advisory, including CVE-2024-22031.

CVE-2024-22031

Known affected: 3 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-22031 (GCVE-0-2024-22031)

FKIE_CVE-2024-22031

GHSA-8H6M-WV39-239M

Impact

Patches

Workarounds

References

GSD-2024-22031

OPENSUSE-SU-2025:15059-1

WID-SEC-W-2025-0890

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour