PT-2025-14372 · Rancher · Rancher

Xavier Duthil · Published 2025-03-31 · Updated 2025-04-11 · CVE-2025-23391

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rancher versions prior to v2.8.14 Rancher versions prior to v2.9.8 Rancher versions prior to v2.10.4 Rancher versions prior to v2.11.0

Description A vulnerability has been identified in Rancher where a Restricted Administrator can change the password of Administrators and take over their accounts. This issue arises because a Restricted Administrator should not be allowed to change the password of more privileged users unless they have the Manage Users permissions. The vulnerability can be exploited by abusing elevation control mechanisms, as described in the MITRE ATT&CK Technique T1548.

Recommendations For versions prior to v2.8.14, upgrade to v2.8.14 or later. For versions prior to v2.9.8, upgrade to v2.9.8 or later. For versions prior to v2.10.4, upgrade to v2.10.4 or later. For versions prior to v2.11.0, upgrade to v2.11.0 or later. As a temporary workaround, limit access to Rancher Restricted Admin only to trusted users. Downgrade Restricted Administrators to custom roles with limited permissions.

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

BDU:2025-03876

CVE-2025-23391

GHSA-8P83-CPFG-FJ3G

GO-2025-3586

OPENSUSE-SU-2025:14970-1

Affected Products

Rancher

References · 26

• https://osv.dev/vulnerability/GHSA-8p83-cpfg-fj3g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-23391 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3586 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14970-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03876 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-23391 · Security Note
• https://github.com/rancher/rancher · Note
• https://github.com/rancher/rancher/security/advisories/GHSA-8p83-cpfg-fj3g · Note
• https://suse.com/security/cve/CVE-2025-0312 · Note
• https://twitter.com/cybercronai/status/1910735981663174886 · Twitter Post
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23391 · Note
• https://t.me/cvenotify/118822 · Telegram Post
• https://t.me/cvedetector/22728 · Telegram Post
• https://twitter.com/Brandefense/status/1909578197219373292 · Twitter Post
• https://twitter.com/CVEnew/status/1910646862089961779 · Twitter Post