CVE-2024-22031
Rancher users who can create Projects can gain access to arbitrary projects
Published Oct 15, 2026 · updated Oct 16, 2026 · SUSE rancher
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to s
Oct 15, 2026 · NIST NVD
Updated
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to s
Oct 16, 2026 · NIST NVD
Updated
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to s
Affected
- vendor SUSE rancherversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2024-22031
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the d
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2024-22031
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2024-22031
30-day exploitation probability 0.4%
first.org - NIST NVDVulnerability recordCVE-2024-22031
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the d
nvd.nist.gov