CVE-2026-71404

Rancher Manager's GlobalRole controller takes the name of the ClusterRole it manages from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrites that ClusterRole's rules without verifying ownership of the object (CWE-639, authorization bypass through user-controlled key). A user who has been granted delegated GlobalRole create or update permission can set this annotation to point at any existing ClusterRole — including the built-in `cluster-admin` — causing Rancher to rewrite its rules. The attacker gains the ability to revoke the permissions of every principal bound to the targeted ClusterRole, yielding high integrity and availability impact across the managed scope; because the rewritten rules persist even after the malicious GlobalRole is deleted, the damage is not automatically undone. All Rancher deployments running versions before 2.15.1 are affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade Rancher to 2.15.1 or later. Until patched, restrict which users hold delegated GlobalRole create/update permissions and audit existing GlobalRoles for the `authz.management.cattle.io/cr-name` annotation. Verify whether built-in ClusterRoles such as `cluster-admin` have unexpectedly modified rules and restore them manually, since changes persist after the malicious GlobalRole is deleted.