CVE-2024-58260 HIGH

CVE-2024-58260: Rancher update on users can deny the service to the admin

Vendor Suse
Product rancher
Weakness CWE-863 · Incorrect authorization
Published October 2, 2025
Last update October 2, 2025

CVSS base score

7.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H

What the vulnerability does

01Description

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts.

Key dates

02Disclosure timeline

October 2, 2025 CVE published
October 2, 2025 Record updated