VulnerabilityAwaiting Analysis

CVE-2026-44945

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go).

CRITICAL 9.1EPSS 0.38%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.38% probability · 31th percentile
CISA KEV: Not listed
Weakness: CWE-441, CWE-497
Source: meissner@suse.de

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.