This vulnerability arises from a missing clean-up step in the legacy PRTB reconciler component of Rancher. When an administrator removes Pod Security Admission permissions from a RoleTemplate, the system fails to properly revoke those permissions from users who had them previously. As a result, affected users may continue to hold unauthorized PSA permissions. The issue affects Rancher versions 2.13.0 up to but not including 2.13.7, and 2.14.0 up to but not including 2.14.3. No official patch or remediation level has been published yet.

Users may retain unauthorized Pod Security Admission permissions after an administrator removes those permissions from a RoleTemplate, potentially allowing them to perform actions that should have been revoked. This could lead to privilege escalation within the affected Rancher environments. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should carefully audit and verify user permissions related to Pod Security Admission after changes to RoleTemplates. Consider limiting administrative access to reduce risk.