CVE-2024-22031
Rancher users who can create Projects can gain access to arbitrary projects
Published Oct 15, 2026 · updated Oct 15, 2026 · SUSE rancher
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to s
Affected
- vendor SUSE rancherversion unspecified
Sources
- CIRCL Vulnerability LookupCVE-2024-22031
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the d
vulnerability.circl.lu - CVE.orgCVE-2024-22031
Official CVE identifier
cve.org - NIST NVDCVE-2024-22031
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the d
nvd.nist.gov