The Rancher GitHub authentication provider contains an incorrect authentication caching bug that expands team membership too broadly, resulting in any logged‑in user being granted the principal access of a team member. This flaw allows authenticated users to obtain unauthorized privileges within Rancher services, representing a severe confidentiality and integrity threat. The weakness is classed as CWE‑303: Improper Restriction of Operations within the Bounds of a Resource.

The vulnerability affects SUSE Rancher installations. Versions 2.13.x released before 2.13.6 and 2.14.x released before 2.14.2 contain the exploitable code.

The CVSS score of 8.8 indicates a high‑severity flaw. Because EPSS data is unavailable and the issue is not yet listed in CISA KEV, the exploit probability is uncertain but the scope is significant: any Rancher user with GitHub App authentication enabled could abuse the flaw. The likely attack vector is authenticated use of the GitHub App integration; an attacker would need to log in to Rancher with a GitHub account that triggers the buggy expansion to gain elevated rights.