High severity · published Jun 30, 2026
CVE-2026-44949
Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook
7.0
CVSS
0.4%
EPSS
No
On KEV
Description
A Rancher FleetWorkspace admission path allowed side effects to occur in
the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0 up to 0.9.6 and 0.10.0 up to 0.10.7. An unauthenticated attacker with network access to
the in-cluster rancher-webhook service
could submit a crafted admission payload and cause workspace-related
Kubernetes objects to be created with attacker-chosen identity data.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rancher · SUSE
0.7.0 before 0.7.10; 0.8.0 before 0.8.7; 0.9.0 before 0.9.6; 0.10.0 before 0.10.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44949
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44949
github.com
https://github.com/rancher/webhook/security/advisories/GHSA-h83p-cq95-vph4
More from Rancher
9.9
CVE-2026-44935
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
9.9
CVE-2026-41050
Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
9.9
CVE-2023-22651
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation
9.9
CVE-2021-36783
A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials,…
9.9
CVE-2021-36782
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to…