CVE-2026-44945

9.1 Critique

Publiée le 05/08/2026 à 12:17 · Modifiée le 23/10/2026 à 23:10 · En attente d'analyse NVD · Source : meissner@suse.de

Description

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

Traduire en français

Produits concernés

SUSE Rancher

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	meissner@suse.de	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-441
CWE-497

Références

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945
https://github.com/rancher/rancher/pull/55983
https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories