CVE-2023-32199
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Oct 29, 2025
CISA due date
—
The record
A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters. This only affects custom Global Roles that have a * on * in * rule for resources or have a * on * rule for non-resource URLs
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/rancher/rancher | 0 | 0.0.0-20251014212116-7faa74a968c2 |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0 | 0.0.20251105T184115-1.1 |
Related vulnerabilities
- CVE-2025-67601 A vulnerability has been identified within Rancher Manager, where using self-signed CA… Also affects github.com/rancher/rancher
- GO-2026-4393 Rancher CLI skips TLS verification on Rancher CLI login command in… Also affects github.com/rancher/rancher
- CVE-2024-58269 A vulnerability has been identified in Rancher Manager, where sensitive information… Also affects github.com/rancher/rancher
- CVE-2025-61141 sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because… Also affects govulncheck-vulndb
- CVE-2025-54471 NeuVector used a hard-coded cryptographic key embedded in the source code. Also affects govulncheck-vulndb
- CVE-2025-54470 This vulnerability affects NeuVector deployments only when the Report anonymous cluster… Also affects govulncheck-vulndb
- CVE-2025-54469 A vulnerability was identified in NeuVector, where the enforcer used environment… Also affects govulncheck-vulndb
- CVE-2025-64101 ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection Also affects govulncheck-vulndb