CVE-2026-41052CWE-305

Rancher Privilege Escalation from Project Owner to Host

Critical · published June 29, 2026

CVSS v4.0
9.4
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00423 · 35.6th percentile
Weakness
CWE-305 · Authentication Bypass by Primary Weakness
Published
2026-06-29T15:41Z
EPSS history
Timeline
  • 29 JUN 15:41Z
    Rancher Privilege Escalation from Project Owner to Host
    cvelistv5