CVE-2026-44945: Rancher Cross-Cluster Impersonation Flaw Enables Full Privilege Escalation, Rated CVSS 9.1
Do Son 
TL;DR
A critical flaw lets a low-privileged Rancher user seize full control of the platform. Tracked as CVE-2026-44945, it scores 9.1 on CVSS. This Rancher privilege escalation stems from a cross-cluster impersonation bug.
- CVE: CVE-2026-44945
- CVSS: 9.1 (Critical · CVSSv3)
- Product: SUSE Rancher
- Affected: 2.11.0, 2.12.0, 2.13.0, 2.14.0
- Impact: Cross-Cluster Impersonation Confused-Deputy Privilege Escalation
- Status: No confirmed exploitation yet
- Patched in: 2.11.16, 2.12.12, 2.13.8, 2.14.2 (+1 more)
- EPSS: 0.3% (30-day)
- Action: Update to 2.11.16, 2.12.12, 2.13.8, 2.14.2 (+1 more) now
Why it matters
Rancher manages Kubernetes clusters across many organizations. A successful attack grants control of the whole control plane. From there, it reaches every downstream cluster too. The exposure is severe.
How the attack works
The bug lives in Rancher’s impersonation middleware. It is a classic confused-deputy problem. The authorization check and the actual request run against different clusters.
Rancher runs a SubjectAccessReview against the cluster named in the request URL. However, the real request executes against the local management cluster. An attacker who controls RBAC on any downstream cluster can authorize themselves to impersonate privileged identities.
That gap enables this Rancher privilege escalation. A default user can even import a throwaway cluster to gain that control. No victim interaction and no elevated role are needed.
What an attacker gains
Success exposes all Rancher secrets. That includes kubeconfigs, LDAP passwords, OIDC client secrets, and SAML signing keys. The attacker can also modify GlobalRoleBindings and take full admin control.
Exploitation status
No public proof-of-concept or in-the-wild exploitation has been confirmed. The issue was reported through a GitHub security advisory.
Affected versions
The flaw affects Rancher releases before the fixed builds listed below.
Patch and mitigation
Upgrade now. SUSE fixed the issue in Rancher v2.14.4, v2.13.8, v2.12.12, and v2.11.16. No complete workaround exists without upgrading. As a stopgap, restrict which users may register downstream clusters. See the Rancher security advisory for details.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
