CVE-2026-71404: CWE-639 Authorization bypass through User-Controlled key in SUSE Rancher

The vulnerability arises because the GlobalRole controller in Rancher Manager derives the target ClusterRole name from the user-settable annotation `authz.management.cattle.io/cr-name` and overwrites the ClusterRole's rules without verifying if the user owns or is authorized to modify that ClusterRole. This allows a user with delegated GlobalRole create or update permissions to point the annotation to any existing ClusterRole, such as `cluster-admin`, and revoke all permissions of principals bound to that role. The modification remains effective even after the malicious GlobalRole is deleted, resulting in persistent authorization bypass and privilege revocation.

An attacker with delegated GlobalRole create or update permissions can revoke permissions of all principals bound to any ClusterRole, including highly privileged roles like cluster-admin. This can lead to denial of service for legitimate users and disruption of cluster management. The persistent nature of the change means the impact continues even after the attacker's GlobalRole is removed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict delegated GlobalRole create or update permissions to trusted users only to prevent exploitation.