Home » Database

AVID-2026-R0822

Description

Deleting PRTBs associated to a group doesn’t cause deletion of corresponding RoleBindings (CVE-2021-36775)

Details

a Improper Access Control vulnerability in SUSE Rancher allows users to keep privileges that should have been revoked. This issue affects: SUSE Rancher Rancher versions prior to 2.4.18; Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3.

Reason for inclusion in AVID: The CVE describes an improper access control flaw in SUSE Rancher where deleting PRTBs does not delete corresponding RoleBindings, enabling privilege retention. Rancher is a software component commonly used to deploy and manage containerized workloads, including AI/ML pipelines. This places the vulnerability within the software stack that underpins general-purpose AI systems (deployment/orchestration, runtimes, CI/CD, etc.). It is a security/vulnerability issue with clear CVE details and references, providing sufficient evidence for AVID curation.

References

Affected or Relevant Artifacts

  • Developer: SUSE
  • Deployer: SUSE
  • Artifact Details:
TypeName
SystemRancher
SystemRancher
SystemRancher

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score8.8
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges Required🟢 Low
User InteractionNONE
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-284CWE-284: Improper Access Control

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2022-04-01
  • Version: 0.3.3
  • AVID Entry