What’s Vulnerable › Vulnerabilities
CVE-2026-44947: Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher
- Severity: medium (CVSS 6.9 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-30 · updated 2026-10-25
- Weakness: CWE-281
Description
A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security Admission (PSA) permissions after an administrator removes those permissions from a RoleTemplate.
Affected products
- SUSE Rancher: from 2.13.0 before 2.13.7; from 2.14.0 before 2.14.3 — fixed in 2.13.7, 2.14.3
How to fix
Upgrade to a fixed version: SUSE Rancher 2.13.7, 2.14.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-44947 or the next vulnerability affects your stack