SUSE Rancher Flaws Allow Attackers to Lock Out Admin Accounts

A security flaw in SUSE Rancher Manager has been disclosed as CVE-2024-58260, carrying a high severity rating with a CVSS score of 7.1. According to GBHackers, the issue arises from missing server-side validation on the username field, enabling users with update permissions on User resources to manipulate usernames and disrupt access, including the admin account.

The vulnerability enables two primary attack vectors: username takeover, where a malicious user can set another user’s username to “admin,” and account lockout, which blocks administrative access to the Rancher UI. It specifically requires high privileges to exploit, as attackers must already possess update permissions on User resources, and it affects Rancher Manager versions across multiple release branches.

Organizations are advised to upgrade to patched versions 2.12.2, 2.11.6, 2.10.10, or 2.9.12, and to limit update permissions on user-related resources where patching cannot be applied immediately, according to the disclosure by security researcher Samjustus through GitHub Security Advisory GHSA-q82v-h4rq-5c86.