A flaw in Rancher Manager's role‑based access control allows a non‑administrative user to gain permissions that exceed what they already possess. The inheritedNamespacedRules field of a GlobalRole propagates permissions into namespaces of every downstream cluster without proper privilege validation. This omission gives an unintended elevated access to resources across downstream clusters, constituting a privilege escalation vulnerability. The weakness is classified as a lack of privilege validation (CWE‑306).

The vulnerability affects SUSE Rancher Manager version 2.15.2 and SUSE Rancher Webhook versions 0.11.0 through 0.11.4 and 0.12.0 through 0.12.1. These products are used to orchestrate and manage Kubernetes clusters; the issue resides in their global role handling logic.

The CVSS score of 7.2 indicates a high severity risk. An attacker who can create or modify a GlobalRole binding containing inheritedNamespacedRules can give themselves escalated privileges across downstream clusters. Because the EPSS score is not available, the current model cannot estimate the likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploit at the time. Nevertheless, any user with cluster‑level permissions could unintentionally or intentionally elevate their access, presenting a significant risk for organizations managing multiple downstream clusters.