Command Injection in Rancher Manager Cluster

Executive Summary

CVE-2026-44939 is a critical command injection vulnerability in Rancher Manager versions from 2.10.0 to 2.14.1. It exists in the cluster import endpoint `/v3/import/{token}_{clusterId}.yaml`, specifically in the `authImage` query parameter which is not properly sanitized before being rendered into a Kubernetes manifest template.

Attackers can exploit this by injecting URL-encoded newlines into the `authImage` parameter, allowing them to break out of the intended image field and insert malicious YAML configurations. This can lead to execution of arbitrary containers.

To exploit this, an attacker needs a valid cluster registration token and requires a victim to run `kubectl apply` on a crafted malicious URL. This results in deploying a DaemonSet on all control-plane nodes with privileged access, enabling the attacker to execute commands, access sensitive files like `/etc/kubernetes`, and gain full control over downstream clusters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including full compromise of Rancher-managed Kubernetes clusters. An attacker can execute arbitrary commands on control-plane nodes, deploy malicious containers, and gain privileged access to sensitive cluster data.

The attacker-controlled DaemonSet runs with host network access and privileged service accounts, allowing them to disrupt cluster operations, access confidential information, and potentially spread control to downstream clusters.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting the kube-api-auth DaemonSet in the cattle-system namespace for suspicious configurations that may indicate exploitation.

A suggested command to check for suspicious DaemonSet configurations is:

• kubectl -n cattle-system get daemonset kube-api-auth -o yaml

Review the output for any unexpected or malicious YAML configurations, especially those that might have been injected via the authImage parameter.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include inspecting the kube-api-auth DaemonSet in the cattle-system namespace for suspicious or unauthorized configurations.

Before applying any manifests from the import endpoint, verify their integrity to ensure they have not been tampered with.

Upgrade Rancher Manager to a patched version such as 2.14.2, 2.13.6, 2.12.10, 2.11.14, or 2.10.12, which include validation of the authImage parameter to prevent this injection.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to execute arbitrary commands and gain full control over downstream clusters, including access to sensitive data and the ability to disrupt operations.

Such unauthorized access and control over sensitive data could lead to violations of common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information.

Therefore, exploitation of this vulnerability could compromise compliance with these regulations by exposing or manipulating protected data.

Useful 0 Not Useful 0