CVE-2026-71404: 
Rancher vulnerability analysis and mitigation

CVE-2026-71404 is an authorization bypass vulnerability in SUSE Rancher Manager that allows a user with delegated GlobalRole create or update permissions to overwrite the rules of any existing ClusterRole object by manipulating a user-settable annotation. The flaw affects all Rancher versions before 2.15.1. It was published on September 3, 2026, and carries a CVSS v3.1 base score of 8.7 (High) (Feedly, GitHub PR #56593).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). Rancher's GlobalRole controller reads the authz.management.cattle.io/cr-name annotation — which is settable by any user with GlobalRole create/update rights — to determine the name of the target ClusterRole, then unconditionally overwrites that ClusterRole's rules without verifying that the controller owns or manages the referenced object. An attacker can set this annotation to point at any existing ClusterRole (e.g., cluster-admin), causing the controller to replace its permission rules with those of the malicious GlobalRole. Critically, the corrupted ClusterRole rules persist even after the malicious GlobalRole is deleted, making the impact durable. The fix, implemented in PRs #56593 and #56642, removes the annotation-based name derivation and instead computes ClusterRole names deterministically, treating the annotations as purely informational (GitHub PR #56593, GitHub PR #56642).

Successful exploitation allows an attacker to revoke the permissions of every principal bound to a targeted ClusterRole, including highly privileged roles such as cluster-admin, effectively locking out legitimate administrators and causing a persistent denial of service across the Kubernetes cluster. The integrity impact is high because ClusterRole rules are permanently altered until manually restored, and the availability impact is high because all principals relying on the affected role lose access. Confidentiality is not directly impacted, but the resulting privilege vacuum could facilitate further attacks by other actors (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). Exploitation requires a network-accessible Rancher instance and a user account that has been delegated GlobalRole create or update permissions — a high-privilege precondition that limits the attack surface. The EPSS score is approximately 0.0025 (0.25%), reflecting low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. NVD's SSVC assessment notes exploitation is "none" and technical impact is "total" (Feedly).

1. Identify a target Rancher instance: Locate a Rancher Manager deployment running a version prior to 2.15.1 that is accessible over the network.
2. Obtain delegated GlobalRole permissions: Acquire a user account that has been granted GlobalRole create or update permissions within Rancher (e.g., through a misconfigured role delegation).
3. Craft a malicious GlobalRole manifest: Create a GlobalRole resource with the authz.management.cattle.io/cr-name annotation set to the name of a high-value ClusterRole (e.g., cluster-admin), and define minimal or empty rules in the GlobalRole spec.
4. Apply the malicious GlobalRole: Submit the crafted GlobalRole to the Rancher API using kubectl or the Rancher UI/API with the compromised account's credentials.
5. Trigger controller reconciliation: The GlobalRole controller automatically reconciles and overwrites the targeted ClusterRole's rules with those from the malicious GlobalRole, stripping permissions from all principals bound to that role.
6. Delete the malicious GlobalRole (optional): Remove the GlobalRole to cover tracks; the corrupted ClusterRole rules persist, maintaining the denial-of-service condition until an administrator manually restores the original rules (GitHub PR #56593, Feedly).

• Kubernetes API Audit Logs: Unexpected CREATE or UPDATE events on GlobalRole resources from non-administrative user accounts, particularly those setting the authz.management.cattle.io/cr-name annotation to well-known ClusterRole names (e.g., cluster-admin, edit, view).
• Kubernetes API Audit Logs: Unexpected UPDATE events on ClusterRole objects (especially privileged ones) originating from the Rancher controller service account (cattle-controllers or similar), not from a human administrator.
• Rancher Logs: Rancher controller log entries showing GlobalRole reconciliation targeting ClusterRoles not created by Rancher (e.g., system ClusterRoles).
• Cluster Behavior: Sudden loss of access for multiple principals bound to a specific ClusterRole, particularly cluster-admin or other high-privilege roles, without a corresponding administrator action.
• Resource State: ClusterRole objects with rules that differ from their expected baseline, especially if rules have been emptied or replaced with minimal permissions.

Upgrade Rancher Manager to version 2.15.1 or later, which removes the annotation-based ClusterRole name derivation entirely (patches merged in PRs #56593 for main and #56642 for the v2.15 release branch, as well as backports to v2.14 and v2.13) (GitHub PR #56593, GitHub PR #56642). As an interim workaround, restrict GlobalRole create and update permissions exclusively to trusted administrators and audit all existing role delegations. Additionally, monitor the authz.management.cattle.io/cr-name annotation on GlobalRole resources for any references to system or high-privilege ClusterRoles, and regularly audit ClusterRole rules against a known-good baseline to detect unauthorized changes (Feedly).

The vulnerability received automated tracking coverage from aggregators such as VulDB, CVEFeed, and Bluesky CVE bots shortly after publication. A related Rancher security blog post covering a separate CVE (CVE-2026-75033) was noted in the same timeframe, suggesting broader community attention to Rancher security issues. No notable independent researcher commentary or major media coverage specific to CVE-2026-71404 has been identified beyond standard vulnerability database entries (Feedly).