CVEvulnerability

CVE-2026-44945

9.1 CRITICAL Published 2026-08-05 Modified 2026-10-23 Official page ↗

Status: Awaiting Analysis
Published: 2026-08-05
Last modified: 2026-10-23
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses: CWE-441, CWE-497

Description

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

Weakness · CWE (2)

CWE-441 Unintended Proxy or Intermediary weakness
CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere weakness

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945 bugzilla.suse.com
https://github.com/rancher/rancher/pull/55983 github.com
https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq github.com

CVE-2026-44945

Description

Related

Weakness · CWE (2)

References