CVE-2026-44945
Received Received - Intake

Privilege Escalation in Rancher Control Plane

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: SUSE

Description
A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-44945
EUVD
EUVD-2026-53298

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
rancher rancher From 2.11.0 (inc) to 2.11.16 (exc)
rancher rancher From 2.12.0 (inc) to 2.12.12 (exc)
rancher rancher From 2.13.0 (inc) to 2.13.8 (exc)
rancher rancher From 2.14.0 (inc) to 2.14.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
CWE-497 The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a privilege escalation vulnerability in Rancher's impersonation middleware. An authenticated user with the default global role can gain full administrative access to the Rancher control plane and all downstream clusters it manages. The flaw stems from the middleware authorizing impersonation requests against the wrong cluster, using a downstream cluster's ID instead of the local management cluster.

Detection Guidance

To detect this vulnerability, check Rancher versions against affected ranges (2.11.0-2.11.15, 2.12.0-2.12.11, 2.13.0-2.13.7, 2.14.0-2.14.1). Review audit logs for unusual impersonation requests or unauthorized administrative actions in the Rancher control plane.

Impact Analysis

An attacker with RBAC control on any downstream cluster can impersonate privileged identities, access sensitive secrets like kubeconfigs and credentials, create or modify GlobalRoleBindings, and gain full administrative control over all managed clusters. Exploitation requires an authenticated Rancher session and RBAC control on at least one downstream cluster but no elevated Rancher role or victim interaction.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and access control in standards like GDPR and HIPAA. Full administrative access may result in data breaches, unauthorized modifications, and loss of audit integrity.

Mitigation Strategies

Upgrade Rancher to patched versions (2.11.16, 2.12.12, 2.13.8, 2.14.4 or later) immediately. If upgrading is not possible, restrict user permissions to register downstream clusters to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44945. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart