Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rancher/rancher | go | >= 2.8.0, < 2.9.9 | 2.9.9 |
| github.com/rancher/rancher | go | >= 2.10.0, < 2.10.5 | 2.10.5 |
| github.com/rancher/rancher | go | >= 2.11.0, < 2.11.1 | 2.11.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Rancher using the project name as the namespace for storing project-related resources like PRTBs and secrets. When a user creates a project with the same name as an existing project in a different cluster, this leads to a namespace collision, granting the user unintended access. The patches address this by introducing a backingNamespace field, which is a unique name derived from the cluster name and project name, and updating various functions to use this backingNamespace instead of the project name directly. The identified vulnerable functions are those that, before the patch, used the project name to determine the namespace for resource creation, role binding, or secret management. The GetProjectBackingNamespace function itself, while part of the fix, shows the fallback to p.Name which represents the vulnerable behavior for projects existing before the update. The core issue lies in functions that created namespaces, created role bindings within those namespaces, or accessed resources (like secrets) scoped by these namespaces, using the non-unique project name.
(*Store).Createpkg/api/norman/store/scoped/store.go
(*mgr).reconcileResourceToNamespacepkg/controllers/management/auth/project_cluster_handler.go
(*mgr).reconcileCreatorRTBpkg/controllers/management/auth/project_cluster_handler.go
(*NamespaceController).syncpkg/controllers/managementuser/secret/secret.go
(*projectLifecycle).syncpkg/controllers/management/auth/project_cluster_handler.go
(*nsLifecycle).ensurePRTBAddToNamespacepkg/controllers/managementuser/rbac/namespace_handler.go