-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability, CVE-2023-32199, allows a Rancher user to retain administrative access to clusters even after the GlobalRole or GlobalRoleBinding granting this access has been removed. The root cause is the persistence of ClusterRoleBindings that grant cluster-admin privileges.
My analysis of the patch identified three key functions involved in this process:
rbac.grbHandler.sync: This is the most critical function related to the vulnerability. As the controller for GlobalRoleBindings, it is responsible for managing their lifecycle. The code explicitly ignores deletion events (obj.DeletionTimestamp != nil), which means it fails to trigger the necessary cleanup of the associated ClusterRoleBinding. This omission is the direct cause of the orphaned resource.
rbac.grbHandler.ensureClusterAdminBinding and rbac.clusterHandler.doSync: These two functions are responsible for creating the ClusterRoleBindings in the first place. They are considered part of the vulnerable process because they create resources without a proper lifecycle management mechanism, such as an owner reference, that would ensure they are garbage collected when the parent GlobalRoleBinding is deleted. The patch modifies these functions to add annotations, which allows a new, separate cleanup controller to identify and manage these bindings, confirming they are the source of the orphaned resources.
The patch introduces a new background cleaner (crbCleaner) to periodically scan for and mark orphaned ClusterRoleBindings that were created by the vulnerable functions. This confirms that the original controllers lacked the necessary cleanup logic. Therefore, any runtime profile taken during the setup of the vulnerable state would show calls to ensureClusterAdminBinding or doSync, and the failure to clean up is centered in the grbHandler.sync function's lack of action on deletion.
rbac.grbHandler.syncpkg/controllers/managementuser/rbac/globalrolebinding_handler.go
rbac.grbHandler.ensureClusterAdminBindingpkg/controllers/managementuser/rbac/globalrolebinding_handler.go
rbac.clusterHandler.doSyncpkg/controllers/managementuser/rbac/cluster_handler.go
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rancher/rancher | go | < 0.0.0-20251014212116-7faa74a968c2 | 0.0.0-20251014212116-7faa74a968c2 |
kubectl get clusterrolebinding -o jsonpath='{range .items[?(@.metadata.annotations.authz\.cluster\.cattle\.io/admin-globalrole-missing=="true")]}{.metadata.name}{"\n"}{end}'
Patched versions of Rancher include releases v2.12.3, v2.11.7.
Complications with the restricted admin functionality prevented the patches from being included in v2.10 and v2.9.
If the deployment can't be upgraded to a fixed version, users are advised to manually identify the orphaned ClusterRoleBindings and remove them.
If you have any questions or comments about this advisory:
Ongoing coverage of React2Shell