{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "SUSE Rancher: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/suse--rancher/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/suse--rancher/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2024-22031/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2024-22031/",
   "title": "CVE-2024-22031 disclosed",
   "content_text": "A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.",
   "date_published": "2026-10-15T08:21:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2024-22031/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2024-22031/",
   "title": "CVE-2024-22031 fixed in Chainguard",
   "content_text": "Fixed versions: harvester 1.8.1-r1, harvester-fips 1.8.1-r0, harvester-fips-webhook 1.8.1-r0, harvester-webhook 1.8.1-r1.",
   "date_published": "2026-10-15T08:21:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2024-22031/fixed/go",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2024-22031/",
   "title": "CVE-2024-22031 fixed upstream (Go)",
   "content_text": "Fixed versions: github.com/rancher/rancher 2.10.5, github.com/rancher/rancher 2.11.1, github.com/rancher/rancher 2.9.9.",
   "date_published": "2026-10-15T08:21:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2024-22031/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2024-22031/",
   "title": "CVE-2024-22031 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: govulncheck-vulndb 0.0.20250506T153719-1.1.",
   "date_published": "2026-10-15T08:21:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-88804/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-88804/",
   "title": "CVE-2026-88804 disclosed",
   "content_text": "An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.",
   "date_published": "2026-09-28T15:58:34Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-88805/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-88805/",
   "title": "CVE-2026-88805 disclosed",
   "content_text": "Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2.",
   "date_published": "2026-09-28T15:50:34Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-88808/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-88808/",
   "title": "CVE-2026-88808 disclosed",
   "content_text": "A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files.\n\nThis issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11.",
   "date_published": "2026-09-28T15:36:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-93538/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-93538/",
   "title": "CVE-2026-93538 disclosed",
   "content_text": "A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster.\nThis affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.",
   "date_published": "2026-09-28T14:10:21Z"
  }
 ]
}