CVE-2020-10676
📋 TL;DR
This vulnerability in Rancher 2.x allows users with namespace access to move namespaces between projects without proper authorization. It affects Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4. This is an authorization bypass that could lead to privilege escalation and project boundary violations.
💻 Affected Systems
- Rancher
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with namespace access could move critical namespaces to projects they control, gaining unauthorized access to sensitive workloads, data, and resources across the Kubernetes cluster.
Likely Case
Users with legitimate namespace access could accidentally or intentionally move namespaces to inappropriate projects, causing operational disruption, security boundary violations, and potential data exposure.
If Mitigated
With proper RBAC controls and project isolation, the impact is limited to namespace movement within authorized project boundaries, but still violates intended authorization checks.
🎯 Exploit Status
Exploitation requires authenticated access to a namespace. The vulnerability is in the authorization check logic, making exploitation straightforward for users with namespace permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Rancher 2.6.13 or 2.7.4
Vendor Advisory: https://forums.rancher.com/c/announcements
Restart Required: Yes
Instructions:
1. Backup your Rancher configuration and data. 2. Upgrade to Rancher 2.6.13 if on 2.6.x series. 3. Upgrade to Rancher 2.7.4 if on 2.7.x series. 4. Restart Rancher services. 5. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict namespace movement permissions
allTighten RBAC controls to prevent users from having namespace movement permissions
kubectl edit clusterrole <role-name>
Remove 'update' and 'patch' verbs on namespaces resource
🧯 If You Can't Patch
- Implement strict RBAC controls to limit namespace access and movement permissions
- Monitor namespace movement events and audit logs for unauthorized project transfers
🔍 How to Verify
Check if Vulnerable:
Check Rancher version: kubectl get pods -n cattle-system -l app=rancher -o jsonpath='{.items[0].spec.containers[0].image}' | grep -o 'v[0-9.]*'Check Version:
kubectl get pods -n cattle-system -l app=rancher -o jsonpath='{.items[0].spec.containers[0].image}'Verify Fix Applied:
Confirm version is 2.6.13 or higher for 2.6.x series, or 2.7.4 or higher for 2.7.x series📡 Detection & Monitoring
Log Indicators:
- Namespace update events with project changes
- Unauthorized namespace movement attempts in audit logs
Network Indicators:
- API calls to move namespaces between projects
SIEM Query:
event.action:"update" AND kubernetes.namespace:* AND kubernetes.labels.project:*🔗 References
- https://forums.rancher.com/c/announcements
- https://github.com/advisories/GHSA-8vhc-hwhc-cpj4
- https://github.com/rancher/rancher/releases/tag/v2.6.13
- https://github.com/rancher/rancher/releases/tag/v2.7.4
- https://forums.rancher.com/c/announcements
- https://github.com/advisories/GHSA-8vhc-hwhc-cpj4
- https://github.com/rancher/rancher/releases/tag/v2.6.13
- https://github.com/rancher/rancher/releases/tag/v2.7.4
