Vulnerability · Published Aug 5, 2026 · Assigned by suse

CVE-2026-44945Cross-Cluster Impersonation Confused-Deputy Privilege Escalation

Critical 9.1

In plain English

A critical-severity security flaw in Rancher from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.6%top 53.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

Affected products (as reported)

Vendor	Product	Versions
SUSE	Rancher	2.11.0 – before 2.11.162.12.0 – before 2.12.122.13.0 – before 2.13.82.14.0 – before 2.14.2

Weakness: CWE-441, CWE-497 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/rancher/rancher/pull/55983 patch
https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq vendor-advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945 issue-tracking