SUSE Rancher: Privilege escalation via duplicate project names across clusters
Summary
Rancher stores project-related resources in a namespace named after the project, so two projects with the same name on different clusters share that namespace. A user who can create projects on one cluster can create a project with the same name as a project on another cluster and thereby gain access to that project. The attack requires an authenticated account with project-creation rights on at least one cluster.
Affected
- Rancher 2.8.0 up to 2.9.9 (exact 2.8.x versions not specified)
- Rancher 2.10.0 up to 2.10.5
- Rancher 2.11.0 up to 2.11.1
Fixed in
- Rancher 2.9.9
- Rancher 2.10.5
- Rancher 2.11.1
- No fix for the 2.8 release line.
Workaround
- Do not allow users to create projects with the same names as projects on other clusters.
- Restrict project-creation rights to trusted administrators.
- Run 'kubectl get projects -A -o=custom-columns=NAME:metadata.name | sort | uniq -c' on the local cluster to find duplicate project names; delete and recreate affected projects rather than deleting only some duplicates.
Exploitation
- CISA SSVC: exploitation none, automatable no.
- Not listed in CISA KEV.
- VulDB reports no known exploit and considers exploitation difficult.
- No public proof of concept found in the research; this is unconfirmed.
Our recommendation
- Check whether Rancher is in use and which version runs; identify any 2.8.x installations.
- Upgrade to 2.9.9, 2.10.5, 2.11.1 or later. Plan the upgrade, as duplicate project names must be handled first.
- For 2.8.x, which has no fix, restrict project creation and audit duplicate project names across clusters.
- Review who holds project-creation rights and limit them to necessary users.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8h6m-wv39-239m github.com
- SUSE Bugzilla CVE-2024-22031 bugzilla.suse.com
- GitLab Advisory Database CVE-2024-22031 advisories.gitlab.com
- OSV GHSA-8h6m-wv39-239m osv.dev
- VulDB CVE-2024-22031 vuldb.com
- CISA SSVC via OpenCVE app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:32.
Original description (NVD)
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.