{"id":"EUVD-2024-55800","enisaUuid":"0b3eb2ca-732f-3a3a-bfed-d3a64fe98d1a","description":"A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.","datePublished":"Oct 15, 2026, 8:21:02 AM","dateUpdated":"Oct 16, 2026, 3:56:35 AM","baseScore":8.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2024-22031\nhttps://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m\n","aliases":"CVE-2024-22031\nGHSA-8h6m-wv39-239m\n","assigner":"suse","epss":0.44,"enisaIdProduct":[{"id":"683b924e-5c66-3721-b436-7e0049c72870","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.11.0 \u003c2.11.1"},{"id":"9216b45f-c1e6-331c-9fc6-f3665e0fb77c","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.10.0 \u003c2.10.5"},{"id":"a58d1f18-f842-3f46-b425-5eb296a5d94a","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.8.0 \u003c2.9.9"}],"enisaIdVendor":[{"id":"48f50d54-e97b-3c65-b083-424b74d0cd01","vendor":{"name":"SUSE"}}],"enisaIdVulnerability":[{"id":"862e58a3-83f6-3fa8-ad38-6018c2633424","vulnerability":{"id":"GHSA-8h6m-wv39-239m","description":"Rancher users who can create Projects can gain access to arbitrary projects","datePublished":"Apr 25, 2025, 3:09:26 PM","dateUpdated":"May 23, 2025, 6:36:19 PM","baseScore":0.0,"references":"https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m\nhttps://github.com/rancher/rancher/commit/7f16b596120dd382ce6e9ed0baf83bc23f633054\nhttps://github.com/rancher/rancher/commit/9c1d1c2bfcba36ae4f06c1fd043eb539ad801d4d\nhttps://github.com/rancher/rancher/commit/b0be28f86fc556414bd9b323f05b2b4bf8317c2d\nhttps://github.com/rancher/rancher/commit/f036e8b6ab726c3abbc03bbf7c8d0d53373c84e5\nhttps://github.com/rancher/rancher\nhttps://pkg.go.dev/vuln/GO-2025-3647\n","enisa_id":"EUVD-2024-55800\n","aliases":"GHSA-8h6m-wv39-239m\nCVE-2024-22031\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:11:42 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"db1b65b2-b4bf-3962-9c27-28fc773ef378","vulnerability":{"id":"CVE-2024-22031","description":"A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.","datePublished":"Oct 15, 2026, 8:21:02 AM","dateUpdated":"Oct 16, 2026, 3:56:35 AM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2024-22031\nhttps://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m\n","enisa_id":"EUVD-2024-55800\n","assigner":"suse","epss":0.44,"dataProcessed":"Oct 29, 2026, 7:19:51 AM","vulnerabilityProduct":[{"id":"1120cdae-cc44-3ad3-af0d-4a00c65d616f","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.10.0 \u003c2.10.5"},{"id":"1166885d-0b56-3a4b-8571-76c6f092ac2b","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.11.0 \u003c2.11.1"},{"id":"875c195c-729c-3aa2-9fd2-e5bd5a904a82","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.8.0 \u003c2.9.9"}],"vulnerabilityVendor":[{"id":"b93ec77a-b5c9-3490-9846-1052601c4776","vendor":{"name":"SUSE"}}]}}],"enisaIdAdvisory":[{"id":"1980cbd9-1c91-3920-80cd-4eb16cb0660a","advisory":{"id":"openSUSE-SU-2025:15059-1","description":"govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media","datePublished":"May 7, 2025, 12:00:00 AM","dateUpdated":"Oct 18, 2026, 10:26:24 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15059-1.json\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HNV7O7SNYYY4AFS5HKAPLITKK3B57LE7/\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HNV7O7SNYYY4AFS5HKAPLITKK3B57LE7/\nhttps://www.suse.com/security/cve/CVE-2019-11243/\nhttps://www.suse.com/security/cve/CVE-2023-32198/\nhttps://www.suse.com/security/cve/CVE-2024-22031/\nhttps://www.suse.com/security/cve/CVE-2025-23390/\nhttps://www.suse.com/security/cve/CVE-2025-32777/\nhttps://www.suse.com/security/cve/CVE-2025-3879/\nhttps://www.suse.com/security/cve/CVE-2025-4166/\nhttps://www.suse.com/security/cve/CVE-2025-4210/\nhttps://www.suse.com/security/cve/CVE-2025-46327/\nhttps://www.suse.com/security/cve/CVE-2025-46342/\nhttps://www.suse.com/security/cve/CVE-2025-46569/\nhttps://www.suse.com/security/cve/CVE-2025-46599/\n","aliases":"CVE-2019-11243\nCVE-2023-32198\nCVE-2024-22031\nCVE-2025-23390\nCVE-2025-32777\nCVE-2025-3879\nCVE-2025-4166\nCVE-2025-4210\nCVE-2025-46327\nCVE-2025-46342\nCVE-2025-46569\nCVE-2025-46599\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0e05f718-ad99-371d-aa00-a5ad76b3cee6","product":{"name":"govulncheck-vulndb-0.0.20250506T153719-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"3839ae30-44f1-3456-a197-a14fd52d4d02","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"68a9ceca-58a6-31fa-8e3c-719939718db0","product":{"name":"govulncheck-vulndb-0:0.0.20250506T153719-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6a4e45e6-b90a-3ec6-8f91-4864558e8864","product":{"name":"govulncheck-vulndb-0.0.20250506T153719-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"8fbc1432-35ea-3d64-8822-a14545058c65","product":{"name":"govulncheck-vulndb-0.0.20250506T153719-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"953591f6-d69a-369c-a6de-f379a9b9c770","product":{"name":"govulncheck-vulndb-0:0.0.20250506T153719-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b8e05493-1775-36ab-85bd-2ed31ca6ad69","product":{"name":"govulncheck-vulndb-0:0.0.20250506T153719-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"c3c7f273-c243-3743-9721-c4372d6d222b","product":{"name":"govulncheck-vulndb-0:0.0.20250506T153719-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"eb786e11-5a82-36a1-85e1-81693120f50d","product":{"name":"govulncheck-vulndb-0.0.20250506T153719-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}}]}