CVE-2023-32199: Github.com/rancher/rancher Rancher User Retains Access To Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-j4vr-pcmw-hx59",
  "modified" : "2025-10-29T15:42:32Z",
  "published" : "2025-10-24T15:06:51Z",
  "aliases" : [ "CVE-2023-32199" ],
  "summary" : "Rancher user retains access to clusters despite Global Role removal",
  "details" : "### Impact\nA vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters.\nThis only affects custom Global Roles that:\n- Have a `*` on `*` in `*` rule for resources\n- Have a `*` on `*` rule for non-resource URLs\n\nFor example\n```yaml\napiVersion: management.cattle.io/v3\nkind: GlobalRole\nmetadata:\n  name: custom-admin\nrules:\n  - apiGroups:\n      - '*'\n    resources:\n      - '*'\n    verbs:\n      - '*'\n  - nonResourceURLs:\n      - '*'\n    verbs:\n      - '*'\n```\n\nSpecifically:\n- When a user is bound to a custom admin `GlobalRole`, a corresponding `ClusterRoleBinding` is created on all clusters that binds them to the cluster-admin `ClusterRole`.\n- When such a `GlobalRole` or the `GlobalRoleBinding` (e.g., when the user is unassigned from this role in UI) is deleted, the `ClusterRoleBinding` that binds them to the cluster-admin ClusterRole stays behind.\n\nThis issue allows a user to continue having access to clusters after they have been unassigned from the custom admin global role or the role has been deleted.\n\nPlease consult the associated  [MITRE ATT&CK - Technique - Account Access Removal](https://attack.mitre.org/techniques/T1531/) for further information about this category of attack.\n\n### Patches\nThis vulnerability is addressed by removing the corresponding `ClusterRoleBindings` whenever the admin `GlobalRole` or its `GlobalRoleBindings` are deleted. Previously orphaned `ClusterRoleBindings` are marked with the annotation `authz.cluster.cattle.io/admin-globalrole-missing=true` and should be deleted manually.\n\nOrphaned ClusterRoleBindings can be listed with:\n```\nkubectl get clusterrolebinding -o jsonpath='{range .items[?(@.metadata.annotations.authz\\.cluster\\.cattle\\.io/admin-globalrole-missing==\"true\")]}{.metadata.name}{\"\\n\"}{end}'\n```\n\nPatched versions of Rancher include releases `v2.12.3`, `v2.11.7`.\n\nComplications with the restricted admin functionality prevented the patches from being included in `v2.10` and `v2.9`.\n\n### Workarounds\nIf the deployment can't be upgraded to a fixed version, users are advised to manually identify the orphaned `ClusterRoleBindings` and remove them.\n\n### References\nIf you have any questions or comments about this advisory:\n- Contact the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/rancher/rancher"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20251014212116-7faa74a968c2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/rancher/rancher/security/advisories/GHSA-j4vr-pcmw-hx59"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-32199"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rancher/rancher/pull/52303"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32199"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/rancher/rancher"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-281" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-10-24T15:06:51Z",
    "nvd_published_at" : "2025-10-29T15:15:40Z"
  }
}