CVE-2026-44945

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945
https://github.com/rancher/rancher/pull/55983
https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-05 10:17

Updated : 2026-09-01 20:54

NVD link : CVE-2026-44945

Mitre link : CVE-2026-44945

CVE.ORG link : CVE-2026-44945

JSON object : View

Products Affected

No product.

CWE

CWE-441

Unintended Proxy or Intermediary ('Confused Deputy')

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

{"id": "CVE-2026-44945", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44945", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"repo": "https://github.com/rancher/rancher", "vendor": "SUSE", "product": "Rancher", "versions": [{"status": "affected", "changes": [{"at": "2.11.16", "status": "unaffected"}], "version": "2.11.0", "lessThan": "2.11.16", "versionType": "semver"}, {"status": "affected", "changes": [{"at": "2.12.12", "status": "unaffected"}], "version": "2.12.0", "lessThan": "2.12.12", "versionType": "semver"}, {"status": "affected", "changes": [{"at": "2.13.8", "status": "unaffected"}], "version": "2.13.0", "lessThan": "2.13.8", "versionType": "semver"}, {"status": "affected", "changes": [{"at": "2.14.4", "status": "unaffected"}], "version": "2.14.0", "lessThan": "2.14.2", "versionType": "semver"}], "packageName": "Rancher", "defaultStatus": "unaffected"}]}], "published": "2026-08-05T10:17:27.460", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945", "source": "meissner@suse.de"}, {"url": "https://github.com/rancher/rancher/pull/55983", "source": "meissner@suse.de"}, {"url": "https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq", "source": "meissner@suse.de"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-441"}, {"lang": "en", "value": "CWE-497"}]}], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user\n global role can gain full administrative access to the Rancher control \nplane and transitively to all downstream clusters it manages.\n\nThis issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2."}], "lastModified": "2026-09-01T20:54:51.287", "sourceIdentifier": "meissner@suse.de"}