Rancher Project Name Collision Enables Cross-Cluster Privilege Escalation

A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2024-22031 represents a critical privilege escalation vulnerability in Rancher where insufficient namespace isolation allows an attacker to exploit project naming conventions across clusters. By creating a project with the same name as an existing project in a different cluster, an authenticated user can gain unauthorized access to resources they should not have permissions for. This vulnerability affects any Rancher deployment with multiple clusters and users with project creation capabilities, making it a significant risk for multi-tenant Kubernetes environments. The flaw stems from Rancher using project names as namespace identifiers for storing Project Role Template Bindings (PRTBs) and secrets on the local cluster, creating a collision vulnerability that undermines role-based access control across cluster boundaries.

Casky's 283 mapped skills leverage Claude AI's extended reasoning to correlate this vulnerability with MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). When analyzing Rancher deployments, practitioners using Casky would detect attack patterns including: unauthorized PRTB creation events where project names match across different clusters, anomalous namespace resource access attempts, and suspicious secret retrieval from misaligned namespace contexts. The platform's skill set would flag behavioral indicators such as users creating projects immediately after reconnaissance of existing project names, rapid attempts to access cluster resources outside their assigned scope, and namespace-level permission escalations that deviate from normal role hierarchies. Practitioners would receive findings highlighting the specific MITRE techniques—T1548 (Abuse Elevation Control Mechanism) and T1555 (Credentials from Password Stores)—with contextual detection around how attackers chain cluster reconnaissance with malicious project creation to bypass Rancher's access controls.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2024-22031.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2024-22031

Casky has 283 skills that investigate the attack patterns behind CVE-2024-22031. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn