CVE-2026-104623: Rancher Manager authorization bypass

CVE-2026-104623 describes an authorization bypass in the local shell system of SUSE Rancher Manager management cluster. Access control was not applied to all API routes reaching the handler: an alternative request form bypassed the authorization gate, allowing any authenticated user to execute pods on the management cluster.

The vulnerability has a CVSS score of 6.3 (medium severity) and affects Rancher Manager versions from 2.11.0 to 2.15.3, with possible impact on earlier versions. The status is confirmed: a Proof of Concept is publicly available on GitHub, validated on Rancher 2.15.2 (vulnerable) and 2.15.3 (patched), published on October 30, 2026. Consistency between official NVD description and technical validation confirms reporting reliability.

System administrators managing Rancher must immediately identify versions in use in their environments and upgrade to available patched versions (at least 2.15.3 for the 2.15 branch). Pending patches, monitor management cluster API logs for access to the local shell component by users who should not have this privilege. Also implement additional network access restrictions to the management cluster when possible.