CVE-2024-58267: Rancher Manager Auth Bypass Vulnerability

CVE-2024-58267 Overview

CVE-2024-58267 affects Rancher Manager's Security Assertion Markup Language (SAML) authentication flow initiated from the Rancher command-line interface (CLI). The custom authentication protocol used for SAML-based providers can be abused to steal Rancher authentication tokens through phishing attacks. An attacker who successfully tricks a user into completing a crafted authentication flow can hijack valid session tokens and gain access to Rancher-managed clusters. The weakness maps to CWE-345: Insufficient Verification of Data Authenticity.

Critical Impact
Successful exploitation allows attackers to steal Rancher authentication tokens via phishing, enabling unauthorized access to Kubernetes clusters managed by Rancher.

Affected Products

Rancher Manager (SAML authentication via Rancher CLI)
Deployments using SAML-based identity providers with Rancher
Environments where users authenticate to Rancher via the CLI login flow

Discovery Timeline

2025-10-02 - CVE-2024-58267 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-58267

Vulnerability Analysis

Rancher CLI supports login through external identity providers using SAML. To bridge the browser-based SAML flow with a terminal session, Rancher implements a custom authentication protocol that returns an authentication token to the CLI after the user completes SAML assertion in the browser. This handoff does not sufficiently verify the authenticity of the party requesting the token.

An attacker can craft a phishing link that initiates a Rancher CLI SAML login flow bound to attacker-controlled infrastructure. When the victim authenticates through their legitimate identity provider, the resulting Rancher authentication token is delivered to the attacker instead of the intended CLI session. The attacker then reuses the token to interact with the Rancher API as the victim.

Root Cause

The root cause is insufficient verification of the authenticity of the CLI endpoint receiving the token in the SAML callback exchange. The custom protocol trusts client-supplied parameters that determine where authentication material is delivered. This makes the flow susceptible to phishing scenarios in which the user believes they are logging into their own CLI while binding the session to an attacker.

Attack Vector

Exploitation requires user interaction and low privileges but produces a scope change with high impact on confidentiality, integrity, and availability. The attack chain is:

The attacker sends a crafted URL to a Rancher user, typically via email, chat, or a spoofed documentation page.
The victim clicks the link and completes SAML authentication against the legitimate identity provider.
Rancher issues an authentication token, which is redirected to attacker-controlled infrastructure due to the flawed CLI callback protocol.
The attacker uses the stolen token against the Rancher API to access clusters, workloads, and secrets available to the victim.

For technical specifics, refer to the GitHub Security Advisory GHSA-v3vj-5868-2ch2 and the SUSE Bug Report for CVE-2024-58267. No verified public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2024-58267

Indicators of Compromise

Rancher audit log entries showing CLI-initiated SAML logins followed by API calls originating from unexpected source IP addresses or geographies.
Authentication tokens used from user-agents inconsistent with the legitimate rancher CLI binary.
Short intervals between a successful SAML assertion and API activity from a different network location.

Detection Strategies

Correlate Rancher authentication events with identity provider SAML assertion logs to identify tokens redeemed outside sanctioned client environments.
Alert on Rancher API requests where the session token was issued through a CLI flow but is used from IP ranges not associated with corporate endpoints or jump hosts.
Hunt for user reports of unusual Rancher login prompts or unexpected browser redirects following clicks on external links.

Monitoring Recommendations

Enable and centralize Rancher audit logging with token issuance and API call metadata forwarded to a SIEM.
Monitor identity provider logs for SAML authentications with RelayState or callback parameters that reference non-approved hosts.
Track privileged Rancher API operations (cluster creation, role bindings, kubeconfig downloads) and require secondary review when preceded by CLI logins from new locations.

How to Mitigate CVE-2024-58267

Immediate Actions Required

Upgrade Rancher Manager to a fixed release as identified in the GitHub Security Advisory GHSA-v3vj-5868-2ch2.
Invalidate existing Rancher authentication tokens and require users to re-authenticate through the CLI after upgrading.
Communicate the phishing risk to Rancher users and instruct them not to complete CLI login flows initiated from links they did not personally start.

Patch Information

SUSE and the Rancher project have published fixed versions and remediation guidance. Refer to the GitHub Security Advisory GHSA-v3vj-5868-2ch2 for the specific patched releases and to the SUSE Bug Report for CVE-2024-58267 for vendor tracking. Apply the vendor patch as the primary remediation.

Workarounds

Restrict CLI-based SAML authentication and require users to obtain kubeconfig credentials through vetted internal workflows until patches are applied.
Shorten Rancher token time-to-live values so stolen tokens have limited operational value.
Enforce network egress controls that limit which hosts can receive Rancher CLI callback traffic from user workstations.
Deliver targeted user awareness training focused on Rancher-specific phishing scenarios and validating CLI login origin.