[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2023-32199":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":20,"cwes":21,"cpes":23,"technologies":25,"references":27,"score":33,"epss_score":34,"epss_percentile":35,"is_kev":36,"cisa_kev_date_added":37,"cisa_kev_due_date":37,"cisa_ssvc":38,"attack_mappings":48,"exploits":55},322446,"CVE-2023-32199","EUVD-2023-36458","Rancher user retains access to clusters despite Global Role removal\n\n### Impact\nA vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters.\nThis only affects custom Global Roles that:\n- Have a `*` on `*` in `*` rule for resources\n- Have a `*` on `*` rule for non-resource URLs\n\nFor example\n```yaml\napiVersion: management.cattle.io\u002Fv3\nkind: GlobalRole\nmetadata:\n  name: custom-admin\nrules:\n  - apiGroups:\n      - '*'\n    resources:\n      - '*'\n    verbs:\n      - '*'\n  - nonResourceURLs:\n      - '*'\n    verbs:\n      - '*'\n```\n\nSpecifically:\n- When a user is bound to a custom admin `GlobalRole`, a corresponding `ClusterRoleBinding` is created on all clusters that binds them to the cluster-admin `ClusterRole`.\n- When such a `GlobalRole` or the `GlobalRoleBinding` (e.g., when the user is unassigned from this role in UI) is deleted, the `ClusterRoleBinding` that binds them to the cluster-admin ClusterRole stays behind.\n\nThis issue allows a user to continue having access to clusters after they have been unassigned from the custom admin global role or the role has been deleted.\n\nPlease consult the associated  [MITRE ATT&CK - Technique - Account Access Removal](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1531\u002F) for further information about this category of attack.\n\n### Patches\nThis vulnerability is addressed by removing the corresponding `ClusterRoleBindings` whenever the admin `GlobalRole` or its `GlobalRoleBindings` are deleted. Previously orphaned `ClusterRoleBindings` are marked with the annotation `authz.cluster.cattle.io\u002Fadmin-globalrole-missing=true` and should be deleted manually.\n\nOrphaned ClusterRoleBindings can be listed with:\n```\nkubectl get clusterrolebinding -o jsonpath='{range .items[?(@.metadata.annotations.authz\\.cluster\\.cattle\\.io\u002Fadmin-globalrole-missing==\"true\")]}{.metadata.name}{\"\\n\"}{end}'\n```\n\nPatched versions of Rancher include releases `v2.12.3`, `v2.11.7`.\n\nComplications with the restricted admin functionality prevented the patches from being included in `v2.10` and `v2.9`.\n\n### Workarounds\nIf the deployment can't be upgraded to a fixed version, users are advised to manually identify the orphaned `ClusterRoleBindings` and remove them.\n\n### References\nIf you have any questions or comments about this advisory:\n- Contact the [SUSE Rancher Security team](https:\u002F\u002Fgithub.com\u002Francher\u002Francher\u002Fsecurity\u002Fpolicy) for security related inquiries.\n- Open an issue in the [Rancher](https:\u002F\u002Fgithub.com\u002Francher\u002Francher\u002Fissues\u002Fnew\u002Fchoose) repository.\n- Verify with our [support matrix](https:\u002F\u002Fwww.suse.com\u002Fsuse-rancher\u002Fsupport-matrix\u002Fall-supported-versions\u002F) and [product support lifecycle](https:\u002F\u002Fwww.suse.com\u002Flifecycle\u002F).","2025-10-24T15:06:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":18,"attackComplexity":17,"availabilityImpact":17,"privilegesRequired":19,"confidentialityImpact":17},"UNCHANGED","3.1",4.3,"NETWORK","MEDIUM","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:H\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L","LOW","REQUIRED","HIGH",true,[22],"CWE-281",[24],"cpe:2.3:a:rancher:rancher:*:*:*:*:*:*:*:*",[26],"Rancher Rancher",[28,29,30,31,32],"https:\u002F\u002Fbugzilla.suse.com\u002Fshow_bug.cgi?id=CVE-2023-32199","https:\u002F\u002Fgithub.com\u002Francher\u002Francher\u002Fsecurity\u002Fadvisories\u002FGHSA-j4vr-pcmw-hx59","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2023-32199","https:\u002F\u002Fgithub.com\u002Francher\u002Francher\u002Fpull\u002F52303","https:\u002F\u002Fgithub.com\u002Francher\u002Francher",0.42,0.00222,0.12615,false,null,{"timestamp":39,"automatable":40,"tech_impact":41,"exploitation":42,"cisa_decision":43,"cisa_remediation_timeline":47},"2025-10-29T15:13:25.439463Z","no","partial","none",{"vector":44,"decision":45,"priority":46},"CISAv1\u002FE:N\u002FA:N\u002FT:P\u002FM:H\u002F2026-10-25T15:37:56.218335\u002F","track_star","medium","60D",[49],{"name":50,"source":51,"tactics":52,"technique_id":54},"Exploit Public-Facing Application","attack_vector",[53],"initial-access","T1190",[]]