NIXPKGS-2026-2035

GitHub issue published 3 weeks, 4 days ago

Over-inclusive team membership expansion in GitHub App authentication provider for Rancher

Permalink CVE-2026-41053

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 3 weeks, 4 days ago by @LeSuisse Activity log

Created suggestion 3 weeks, 4 days ago
@LeSuisse ignored
2 packages
- terraform-providers.rancher2
- terraform-providers.rancher_rancher2
3 weeks, 4 days ago
@LeSuisse accepted 3 weeks, 4 days ago
@LeSuisse published on GitHub 3 weeks, 4 days ago

Over-inclusive team membership expansion in GitHub App authentication provider for Rancher

Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.