Rancher · Rancher · CVE-2023-32194
**Name of the Vulnerable Software and Affected Versions**
Rancher versions 2.6.0 through 2.6.13
Rancher versions 2.7.0 through 2.7.9
Rancher versions 2.8.0 through 2.8.1
**Description**
A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces". This can lead to someone being capable of accessing, creating, updating, or deleting a namespace in the project. The subject will receive * permissions for core namespaces, regardless of the API group. This can result in leakage of secrets and abuse of resource quotas.
**Recommendations**
For Rancher versions 2.6.0 through 2.6.13, update to version 2.6.14.
For Rancher versions 2.7.0 through 2.7.9, update to version 2.7.10.
For Rancher versions 2.8.0 through 2.8.1, update to version 2.8.2.
As a temporary workaround, consider restricting the use of global roles for resource type "namespaces" until a patch is available. Avoid granting create or * global roles for "namespaces" to minimize the risk of exploitation.