Privilege Escalation Vulnerability in Rancher by Rancher Labs
CVE-2026-44945

9.1CRITICAL

Key Information:

Vendor

Suse
Status
Rancher
Vendor
CVE Published:
5 August 2026

What is CVE-2026-44945?

A vulnerability in Rancher's impersonation middleware allows an authenticated user with a default global role to escalate privileges, gaining full administrative access to the Rancher control plane. This access can affect all downstream clusters managed by the Rancher instance, potentially compromising the entire environment.

Affected Version(s)

Rancher 2.11.0 < 2.11.16

Rancher 2.12.0 < 2.12.12

Rancher 2.13.0 < 2.13.8

References

https://github.com/rancher/rancher/pull/55983
patch
https://github.com/rancher/rancher/security/advisories/GH...
vendor-advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945
issue-tracking

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was discovered and reported by @BenTheCyberOne.
.