CVE-2024-22031

HighCVSS 8.5/10Last modified Oct 27, 2026

Description

A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
SUSE	rancher	>= 2.8.0, < 2.9.9; >= 2.10.0, < 2.10.5; >= 2.11.0, < 2.11.1

References

Timeline

Published: Oct 15, 2026
Last modified: Oct 27, 2026
NVD status: Awaiting Analysis

Related CVEs from 2024

CVE-2024-220326.5A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled.CVE-2024-220336.3The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to CVE-2024-220345.5Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configu CVE-2024-220369.1A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root acces CVE-2024-220375.5The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be sho CVE-2024-220387.3Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of se CVE-2024-220399.8A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All vers CVE-2024-22045.5Zemana AntiLogger v2.74.204.664 is vulnerable to a Denial of Service (DoS) vulnerability by triggering the 0x80002004 and 0x80002010 IOCTL c CVE-2024-220407.5A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions),CVE-2024-220417.5A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions),CVE-2024-220427.8A vulnerability has been identified in Unicam FX (All versions). The windows installer agent used in affected product contains incorrect use CVE-2024-220435.5A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.251), Parasolid V35.1 (All versions < V35.1.170). The affected