CVE-2026-44945CWE-441CWE-497

CVE-2026-44945

Critical · published August 5, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user

global role can gain full administrative access to the Rancher control

plane and transitively to all downstream clusters it manages.

This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00560 · 45.9th percentile
Weaknesses
CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy'); CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2026-08-05T14:17Z
References (3)
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945 · [email protected]https://github.com/rancher/rancher/pull/55983 · [email protected]https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq · [email protected]
EPSS history
Timeline
  • 05 AUG 10:00Z
    Cross-Cluster Impersonation Confused-Deputy Privilege Escalation
    cvelistv5