CVE-2026-104623

MediumCVSS 6.3/10Last modified Oct 30, 2026

Description

A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-290

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 30, 2026
Last modified: Oct 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1046256.3A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index CVE-2026-1046268.8A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that i CVE-2026-1046275.4The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in CVE-2026-1046286.5Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with CVE-2026-1046298.8A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to l CVE-2026-1046328.8Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun CVE-2026-1046336.5When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its pa CVE-2026-1046342.3Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null CVE-2026-1046358.2Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash CVE-2026-1046367.5Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent CVE-2026-1046377.3A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected elem CVE-2026-1046385.3A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The i