What’s Vulnerable › Vulnerabilities
CVE-2026-41053: Over-inclusive team membership expansion in GitHub App authentication provider for Rancher
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-30 · updated 2026-10-25
- Weakness: CWE-303
Description
Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.
Affected products
- SUSE Rancher: from 2.13.0 before 2.13.6; from 2.14.0 before 2.14.2 — fixed in 2.13.6, 2.14.2
How to fix
Upgrade to a fixed version: SUSE Rancher 2.13.6, 2.14.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-41053 or the next vulnerability affects your stack