What’s Vulnerable › Vulnerabilities
CVE-2026-44939: Command injection through unsanitized YAML parameter in Rancher
- Severity: critical (CVSS 9.4 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-19 · updated 2026-10-26
- Weakness: CWE-95
Description
A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.
Affected products
- SUSE Rancher: from 2.14.0 before 2.14.2; from 2.13.0 before 2.13.6; from 2.12.0 before 2.12.10; from 2.11.0 before 2.11.14; from 2.10.0 before 2.10.12 — fixed in 2.10.12, 2.11.14, 2.12.10, 2.13.6, 2.14.2
How to fix
Upgrade to a fixed version: SUSE Rancher 2.10.12, 2.11.14, 2.12.10, 2.13.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-44939 or the next vulnerability affects your stack