Is CVE-2026-104623 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104623?

CVE-2026-104623 has a CVSS v3 severity of MEDIUM (6.3).

Back

CVE-2026-104623

Description

A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.