CVE-2026-41053CWE-303

Over-inclusive team membership expansion in GitHub App authentication provider for Rancher

High · published June 30, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00524 · 43.6th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2026-06-30T11:38Z
EPSS history
Timeline
  • 30 JUN 11:38Z
    Over-inclusive team membership expansion in GitHub App authentication provider for Rancher
    cvelistv5