CVE-2024-58260: Rancher Manager Auth Bypass Vulnerability

CVE-2024-58260 Overview

CVE-2024-58260 is an authorization flaw in Rancher Manager caused by missing server-side validation on the .username field of User resources. Users with update permissions on other User resources can modify the .username field to trigger a denial of access against targeted accounts. The issue is classified under CWE-863: Incorrect Authorization. Exploitation requires authenticated access with elevated permissions on User resources, but the impact extends across the Rancher-managed environment because affected accounts lose the ability to authenticate.

Critical Impact
An authenticated attacker with update permissions on User resources can lock legitimate users out of Rancher Manager by manipulating the unvalidated .username field, disrupting cluster administration.

Affected Products

Rancher Manager (SUSE Rancher)
Rancher-managed Kubernetes clusters relying on Rancher authentication
Downstream environments dependent on Rancher User resource integrity

Discovery Timeline

2025-10-02 - CVE-2024-58260 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-58260

Vulnerability Analysis

Rancher Manager exposes User resources through its Kubernetes-style API. The API server accepts updates to the .username field without enforcing server-side validation. An authenticated principal with update permissions on other User resources can rewrite the .username value on a targeted account.

Because Rancher uses .username to correlate authentication attempts with the underlying User resource, altering the field breaks that correlation. The targeted user is unable to log in even though the account, its role bindings, and its credentials remain intact. The attack does not require network-level access to internal components and is executed through the standard Rancher API surface.

The flaw is scoped as an authorization weakness rather than a code-execution or data-disclosure issue. However, the scope change reflects that a compromised or over-privileged account in one namespace can affect authentication state for principals used across managed clusters.

Root Cause

The root cause is missing input validation on a security-relevant identifier. Rancher's admission and update logic does not verify that .username remains consistent, unique, or bound to the identity provider mapping when a User resource is updated. Trust is placed in client-supplied values rather than enforced by the server.

Attack Vector

An attacker authenticates to Rancher Manager as a principal that holds update permissions on User resources. The attacker issues an update against a target User resource and modifies the .username field to an arbitrary value. On the next login attempt, the target account fails to resolve, denying access. The vulnerability details are documented in the GitHub Security Advisory GHSA-q82v-h4rq-5c86 and tracked in SUSE Bugzilla.

Detection Methods for CVE-2024-58260

Indicators of Compromise

Audit log entries showing PATCH or PUT operations against users.management.cattle.io resources where the .username field is modified
Sudden authentication failures for previously working accounts without corresponding password or role changes
User resource objects whose .username no longer matches the associated identity provider principal ID

Detection Strategies

Enable Rancher audit logging at the metadata or request level and alert on any update to the .username field of User resources
Correlate Kubernetes API audit events with Rancher authentication failure events to surface targeted lockout patterns
Baseline which service accounts and roles legitimately hold update permissions on User resources and flag deviations

Monitoring Recommendations

Ingest Rancher and Kubernetes API server audit logs into a centralized analytics platform for retention and query
Alert on privilege changes that grant update on users.management.cattle.io outside of change-management windows
Track login-failure rate per user and trigger investigation when established accounts begin failing to resolve

How to Mitigate CVE-2024-58260

Immediate Actions Required

Apply the fixed Rancher Manager release referenced in the GitHub Security Advisory GHSA-q82v-h4rq-5c86
Audit all principals and roles that grant update permissions on User resources and revoke unnecessary access
Review current User resources for unexpected .username values and restore them from a known-good source

Patch Information

SUSE has published fixes for Rancher Manager. Refer to the SUSE Bugzilla entry for CVE-2024-58260 and the vendor security advisory for the exact fixed versions applicable to your deployment channel.

Workarounds

Restrict update verbs on users.management.cattle.io through Rancher global roles and Kubernetes RBAC until patching is complete
Require multi-party approval or GitOps-managed change control for any modification to User resources
Maintain out-of-band administrator accounts sourced directly from the identity provider to recover access if lockout occurs

bash

# Example: list principals with update permission on Rancher User resources
kubectl get clusterrole,role -A -o json | \
  jq '.items[] | select(.rules[]? | 
    (.resources[]? == "users") and 
    (.apiGroups[]? == "management.cattle.io") and 
    (.verbs[]? == "update" or .verbs[]? == "*")) | 
    {kind: .kind, name: .metadata.name, namespace: .metadata.namespace}'