The vulnerability allows an authenticated user who can create projects to create a new project with the same name as an existing project in another cluster. Because Rancher uses the project name as the namespace for storing resources, the newly created project inherits access to the namespace of the pre‑existing project, giving the attacker unauthorized access to that project’s resources. This is an authorization flaw (CWE‑863) that can lead to privilege escalation and data exposure.

The issue affects Rancher deployments provided by SUSE. No specific versions are listed in the advisory, so all Rancher releases hosted by SUSE should be inspected for the presence of this flaw.

The CVSS base score is 8.5, indicating high severity. The EPSS score is below 1 %, showing a low but non‑zero probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The exploit requires a user with permission to create projects but not full cluster administrator rights, making it a realistic risk in environments where that permission is granted to many users. The attack vector is likely authenticated, leveraging normal project‑creation functionality to bypass isolation between clusters.