CVE-2026-41053

Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh	Patch Vendor Advisory Mitigation

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:suse:rancher::::::::
	cpe:2.3:a:suse:rancher::::::::

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El almacenamiento en caché incorrecto de la autenticación en la expansión de la membresía del equipo del proveedor de autenticación de Rancher Github causó que otorgara acceso principal a cualquier usuario que haya iniciado sesión, en 2.13 antes de 2.13.6 y 2.14 antes de 2.14.2.

Information

Published : 2026-06-30 12:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-41053

Mitre link : CVE-2026-41053

CVE.ORG link : CVE-2026-41053

JSON object : View

Products Affected

suse

rancher

CWE

CWE-303

Incorrect Implementation of Authentication Algorithm

{"id": "CVE-2026-41053", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41053", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-30T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"repo": "https://github.com/rancher/rancher/", "vendor": "SUSE", "modules": ["github auth provider"], "product": "Rancher", "versions": [{"status": "affected", "version": "2.14.0", "lessThan": "2.14.2", "versionType": "semver"}, {"status": "affected", "version": "2.13.0", "lessThan": "2.13.6", "versionType": "semver"}], "packageName": "Rancher", "defaultStatus": "unaffected"}]}], "published": "2026-06-30T12:16:23.580", "references": [{"url": "https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh", "tags": ["Patch", "Vendor Advisory", "Mitigation"], "source": "meissner@suse.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-303"}]}], "descriptions": [{"lang": "en", "value": "Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2."}, {"lang": "es", "value": "El almacenamiento en cach\u00e9 incorrecto de la autenticaci\u00f3n en la expansi\u00f3n de la membres\u00eda del equipo del proveedor de autenticaci\u00f3n de Rancher Github caus\u00f3 que otorgara acceso principal a cualquier usuario que haya iniciado sesi\u00f3n, en 2.13 antes de 2.13.6 y 2.14 antes de 2.14.2."}], "lastModified": "2026-10-25T21:10:00.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53E5872E-9F92-4D2E-858D-4563A955B929", "versionEndExcluding": "2.13.6", "versionStartIncluding": "2.13.0"}, {"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CF3233E-9836-4A06-A063-C83D9AE88156", "versionEndExcluding": "2.14.2", "versionStartIncluding": "2.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "meissner@suse.de"}