Rancher GitHub Authentication Caching Grants Unintended Access

This vulnerability stems from incorrect authentication caching in Rancher's GitHub authentication provider, specifically affecting the team membership expansion feature. When a user authenticates via GitHub, the system caches authentication results but fails to properly validate whether subsequent users should inherit the same permissions. This results in any logged-in user being granted principal access regardless of their actual GitHub team membership, effectively breaking role-based access control (RBAC). Rancher deployments using GitHub authentication in versions 2.13 before 2.13.6 and 2.14 before 2.14.2 are affected, putting multi-tenant environments and enterprise clusters at significant risk of lateral movement and unauthorized access to sensitive workloads.

While this CVE currently maps to no specific MITRE ATT&CK techniques, Casky's Claude-powered analysis would detect attack patterns associated with privilege escalation and credential misuse. A practitioner using Casky would observe findings related to identity provider misconfiguration, improper session handling, and authorization bypass patterns. The platform's 754 mapped security skills would flag anomalies such as: unexpected privilege grants without corresponding audit events, users accessing resources outside their GitHub team scope, cached credentials persisting across authentication boundaries, and failed authentication attempts followed by successful access. Extended reasoning analysis would correlate these signals to identify the root cause—authentication caching that ignores group membership validation—and distinguish this from legitimate access patterns, enabling teams to remediate before exploitation occurs.