What’s Vulnerable › Vulnerabilities

CVE-2026-44945: Cross-Cluster Impersonation Confused-Deputy Privilege Escalation

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-05 · updated 2026-10-23
• Weakness: CWE-441

Description

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

Affected products

• SUSE Rancher: from 2.11.0 before 2.11.16; from 2.12.0 before 2.12.12; from 2.13.0 before 2.13.8; from 2.14.0 before 2.14.2 — fixed in 2.11.16, 2.12.12, 2.13.8, 2.14.2

How to fix

Upgrade to a fixed version: SUSE Rancher 2.11.16, 2.12.12, 2.13.8, 2.14.2. Check the vendor advisory for mitigations.

References

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945
• https://github.com/rancher/rancher/pull/55983
• https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq

Get alerted when CVE-2026-44945 or the next vulnerability affects your stack