CVE-2026-44945 Cross-Cluster Impersonation Confused-Deputy Privilege Escalation
An authenticated user with default global role can escalate privileges to gain full administrative access to the Rancher control plane and all downstream clusters.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44945?
CVE-2026-44945 is a critical vulnerability in SUSE Rancher, published on 5 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages.
This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.
Which versions are affected by CVE-2026-44945?
How do I fix CVE-2026-44945?
No fix has been published for CVE-2026-44945 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-44945 being exploited?
There is no known exploitation of CVE-2026-44945 in the wild and no public exploit code.
Sources
Also known as GHSA-v584-7w32-jwpq.