{"cve":"CVE-2023-22651","nvd":{"published":"2023-05-04T08:15:22.893","modified":"2026-06-17T05:35:51.390","status":"Modified","description":"Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead to\n the misconfiguration of the Webhook. This component enforces validation\n rules and security checks before resources are admitted into the \nKubernetes cluster.\nThe issue only affects users that upgrade from 2.6.x or 2.7.x to 2.7.2. Users that did a fresh install of 2.7.2 (and did not follow an upgrade path) are not affected.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9},"cwes":["CWE-269","CWE-276"],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22651","https://github.com/rancher/rancher/security/advisories/GHSA-6m9f-pj6w-w87g","https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22651","https://github.com/rancher/rancher/security/advisories/GHSA-6m9f-pj6w-w87g"],"products":["suse:rancher"],"source":"nvd","synced_at":"2026-10-19T21:38:18.424950729+00:00"},"epss":{"cve":"CVE-2023-22651","score":0.00779,"percentile":0.55905,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-6m9f-pj6w-w87g","url":"https://osv.dev/vulnerability/GHSA-6m9f-pj6w-w87g","summary":"Rancher Webhook is misconfigured during upgrade process","modified":"2026-07-08T06:27:39.606854118Z","packages":[{"ecosystem":"Go","name":"github.com/rancher/rancher","purl":"pkg:golang/github.com/rancher/rancher","ranges":[">=2.7.2 <2.7.3"],"fixed":["2.7.3"]},{"ecosystem":"Go","name":"github.com/rancher/rancher","purl":"pkg:golang/github.com/rancher/rancher","ranges":[">=0.0.0-20220922131902-ec6d6d3a7616 <0.0.0-20230424183121-6d9a175954c6"],"fixed":["0.0.0-20230424183121-6d9a175954c6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}