Improper privilege handling allows a user who holds the Project Owner role to elevate privileges to the host level, effectively giving them unrestricted access to the underlying infrastructure. This weakness falls under CWE-305, which covers insufficient segregation of privilege between distinct functional areas. The result is a serious breach of confidentiality, integrity, and availability for the host environment. The description clearly states that users with Project Owner permissions can exploit the system to gain elevated host privileges, which could lead to full system compromise.

The vulnerability affects Rancher products from SUSE, specifically Rancher versions 2.14 prior to 2.14.2, 2.13 prior to 2.13.6, and 2.12 prior to 2.12.10. Any deployment running these affected versions is susceptible unless the operating environment is patched or the offset roles are remediated.

The CVSS score of 9.4 indicates a critical level of risk, while the EPSS score is currently unavailable, meaning no public evidence of exploitation yet. The vulnerability is not listed in the CISA KEV catalog, but the high severity and potential for internal privilege escalation render it highly significant. The likely attack vector is internal; an attacker must possess or obtain a Project Owner role within Rancher to exploit the flaw. Such a role may be granted following an initial compromise or due to misconfiguration, after which the attacker can execute commands on the host with full control.