Vulnerability · Published Jun 19, 2026 · Assigned by suse
CVE-2026-44939Command injection through unsanitized YAML parameter in Rancher
Critical 9.4
In plain English
A critical-severity security flaw in Rancher from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)1.3%top 29.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/rancher/rancher | 2.14.2 | GHSA-mhc6-2gfq-xx62 |
| Go | github.com/rancher/rancher | 2.13.6 | GHSA-mhc6-2gfq-xx62 |
| Go | github.com/rancher/rancher | 2.12.10 | GHSA-mhc6-2gfq-xx62 |
| Go | github.com/rancher/rancher | 2.11.14 | GHSA-mhc6-2gfq-xx62 |
| Go | github.com/rancher/rancher | 2.10.12 | GHSA-mhc6-2gfq-xx62 |
| Go | github.com/rancher/rancher | 0.0.0-20260617231817-2aa77eb283e7 | GHSA-mhc6-2gfq-xx62 |
| Go | github.com/rancher/rancher | 0.0.0-20260617231817-2aa77eb283e7 | GO-2026-5875 |
Affected products (as reported)
Weakness: CWE-95 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H