CVE-2024-22031
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.
- CVSS 3.1
- 8.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-25)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8h6m-wv39-239m | Go | github.com/rancher/rancher | >=2.8.0 <2.9.9 | 2.9.9 |
| GHSA-8h6m-wv39-239m | Go | github.com/rancher/rancher | >=2.10.0 <2.10.5 | 2.10.5 |
| GHSA-8h6m-wv39-239m | Go | github.com/rancher/rancher | >=2.11.0 <2.11.1 | 2.11.1 |
| GO-2025-3647 | Go | github.com/rancher/rancher | all versions | no fix published |