Three 9.0+ Kubernetes privesc bugs: Red Hat ACM, Rancher, and ClusterCurator all wide open

A bug in Rancher's impersonation middleware lets any authenticated user with just the default "user" global role escalate to full Rancher admin. That means control over the Rancher management plane and every downstream cluster it manages. The only prerequisite is a valid Rancher login.

Affected estate

Anyone running Rancher 2.11.0 through 2.11.15, 2.12.0 through 2.12.11, 2.13.0 through 2.13.7, or 2.14.0 through 2.14.1

How to check

Check your Rancher version in the UI footer or run `kubectl get settings server-version -o jsonpath='{.value}'` on the local/management cluster.

Included because

authenticated default-role user; privilege escalation to admin; affects all downstream clusters; CVSS 9.1

Action

Upgrade Rancher to 2.11.16, 2.12.12, 2.13.8, or 2.14.2 depending on your branch.

Why it matters

Any authenticated user can become full admin of Rancher and all managed clusters. CVSS 9.1.

Source

Rancher / SUSE advisory

A tenant admin with only namespace-scoped privileges can create a ClusterCurator resource that lets them mint a token for a ServiceAccount with cluster-wide admin authority. This is a straightforward privilege escalation from namespace admin to full cluster control, with no unusual conditions required.

Affected estate

Anyone running Red Hat Multicluster Engine for Kubernetes with the ClusterCurator controller

How to check

Run `oc get csv -n multicluster-engine` to check your installed Multicluster Engine version.

Included because

authenticated namespace-scoped user; privilege escalation to cluster-admin; CVSS 9.1

Action

Apply the Red Hat errata for Multicluster Engine that restricts ClusterCurator token minting. Review RBAC for namespace-scoped users who can create ClusterCurator resources.

Why it matters

Namespace-scoped tenant admins can escalate to full cluster-admin. CVSS 9.1.

Source

Red Hat advisory

Rancher's API audit logging middleware reads the full HTTP request body into memory before the body-size limiter gets a chance to enforce its 1 MiB cap. An unauthenticated attacker can hit the public login endpoints with huge request bodies, and a handful of concurrent requests can exhaust memory and crash the Rancher Manager process. That takes down the Rancher API, the UI, and management of all downstream clusters.

Affected estate

Anyone running Rancher Manager with API audit logging enabled

How to check

Verify whether audit logging is active: look for `--audit-log-path` in your Rancher deployment args or `AUDIT_LEVEL` environment variable set to a value other than 0.

Included because

unauthenticated; internet-facing login endpoints; denial of service to management plane; CVSS 7.5

Action

Upgrade Rancher to the patched version. If you can't patch immediately, enforce a body-size limit at your ingress/load balancer layer or temporarily disable audit logging.

Why it matters

Unauthenticated denial of service that can crash the entire Rancher management plane with minimal effort.

Source

Rancher / SUSE advisory

Eclipse Theia's file upload endpoint accepts an attacker-supplied absolute path and writes files there with no authentication and no workspace confinement, in browser-mode deployments up through version 1.73.1. Because the upload uses a CORS-safelisted content type, a malicious web page can trigger the write cross-origin with no preflight. An attacker can overwrite any file the backend process can write to, for example dropping a payload into ~/.bashrc for code execution.

Affected estate

Anyone running Eclipse Theia in browser mode (non-Electron) up through version 1.73.1, especially internet-exposed instances

How to check

Check your Theia version in package.json or the About dialog. Confirm whether the deployment runs in browser mode (not Electron). Test whether POST /file-upload is reachable without authentication.

Included because

unauthenticated; arbitrary file write; potential RCE; no preflight required for cross-origin exploitation; CVSS 8.8

Action

Upgrade Theia past 1.73.1. If immediate upgrade isn't possible, block POST requests to /file-upload at your reverse proxy or WAF.

Why it matters

Unauthenticated arbitrary file write that can escalate to remote code execution. No user interaction needed beyond visiting a malicious page.

Source

Eclipse advisory / NVD