Critical severity · published Aug 5, 2026
CVE-2026-44945
Cross-Cluster Impersonation Confused-Deputy Privilege Escalation
9.1
CVSS
0.6%
EPSS
No
On KEV
Description
A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user
global role can gain full administrative access to the Rancher control
plane and transitively to all downstream clusters it manages.
This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rancher · SUSE
2.11.0 before 2.11.16; 2.12.0 before 2.12.12; 2.13.0 before 2.13.8; 2.14.0 before 2.14.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44945
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44945
bugzilla.suse.com
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945
github.com
https://github.com/rancher/rancher/pull/55983
github.com
https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq
More from Rancher
9.9
CVE-2026-44935
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
9.9
CVE-2026-41050
Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
9.9
CVE-2023-22651
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation
9.9
CVE-2021-36783
A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials,…
9.9
CVE-2021-36782
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to…