---
id: CVE-2026-104623
title: >-
  Authorization bypass on the local cluster shell endpoint allows an
  unauthorized Rancher user to obtain a shell pod on the management cluster
summary: "A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of\_SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.1…"
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-290
vendor: SUSE
product: Rancher
affected:
  - Rancher >= 2.15.0 < 2.15.3
  - Rancher >= 2.14.0 < 2.14.7
  - Rancher >= 2.13.0 < 2.13.11
  - Rancher >= 2.12.0 < 2.12.15
  - Rancher >= 2.11.0 < 2.11.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T17:37:16.874402Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T18:09:00.059Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-104623'
references:
  - url: 'https://github.com/rancher/rancher/security/advisories/GHSA-8x6f-2v58-x6p7'
tags:
  - cve.org
  - exploit-available
epss: 0.00272
epssPercentile: 0.19681
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/googlesky/CVE-2026-104623'
  checkedAt: '2026-11-05T16:25:07.459Z'
ingestedAt: '2026-11-05T16:24:31.312Z'
---

## Overview

A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.

## Affected

- `Rancher >= 2.15.0 < 2.15.3`
- `Rancher >= 2.14.0 < 2.14.7`
- `Rancher >= 2.13.0 < 2.13.11`
- `Rancher >= 2.12.0 < 2.12.15`
- `Rancher >= 2.11.0 < 2.11.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.