Rancher Privilege Escalation from Project Owner to Host
Priority MEDIUM 43CWE-305Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-07
Fix Fixed Rancher (SUSE): 2.12.10, 2.13.6, 2.14.2github.com/rancher/rancher (Go): 2.14.2, 2.13.6, 2.12.10 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SUSE | Rancher | 2.12.0 to before 2.12.10; 2.13.0 to before 2.13.6; 2.14.0 to before 2.14.2 | 2.12.10, 2.13.6, 2.14.2 | Patch available | CNA |
| — | github.com/rancher/rancher (Go) | 2.14.0 to before 2.14.2 | 2.14.2 | Patch available | GHSA-vx8h-4prv-g744 |
| — | github.com/rancher/rancher (Go) | 2.13.0 to before 2.13.6 | 2.13.6 | Patch available | GHSA-vx8h-4prv-g744 |
| — | github.com/rancher/rancher (Go) | 2.12.0 to before 2.12.10 | 2.12.10 | Patch available | GHSA-vx8h-4prv-g744 |
| — | github.com/rancher/rancher (Go) | before 0.0.0-20260513182521-2800aaac25b5 | 0.0.0-20260513182521-2800aaac25b5 | Patch available | GHSA-vx8h-4prv-g744 |
- Rancher VendorSUSE Affected 2.12.0 to before 2.12.10; 2.13.0 to before 2.13.6; 2.14.0 to before 2.14.2 Fixed in 2.12.10, 2.13.6, 2.14.2 Patch available CNA
- github.com/rancher/rancher (Go) Vendor— Affected 2.14.0 to before 2.14.2 Fixed in 2.14.2 Patch available GHSA-vx8h-4prv-g744
- github.com/rancher/rancher (Go) Vendor— Affected 2.13.0 to before 2.13.6 Fixed in 2.13.6 Patch available GHSA-vx8h-4prv-g744
- github.com/rancher/rancher (Go) Vendor— Affected 2.12.0 to before 2.12.10 Fixed in 2.12.10 Patch available GHSA-vx8h-4prv-g744
- github.com/rancher/rancher (Go) Vendor— Affected before 0.0.0-20260513182521-2800aaac25b5 Fixed in 0.0.0-20260513182521-2800aaac25b5 Patch available GHSA-vx8h-4prv-g744
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* | 2.12.0 to before 2.12.10; 2.13.0 to before 2.13.6; 2.14.0 to before 2.14.2 | Vulnerable | SUSE |
- cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* Versions 2.12.0 to before 2.12.10; 2.13.0 to before 2.13.6; 2.14.0 to before 2.14.2 Vulnerable ·SUSE
Remediation
- Fix · CNA Rancher (SUSE) Fixed in 2.12.10, 2.13.6, 2.14.2
- Fix · GHSA-vx8h-4prv-g744 github.com/rancher/rancher (Go) Fixed in 2.14.2 Advisory →
- Fix · GHSA-vx8h-4prv-g744 github.com/rancher/rancher (Go) Fixed in 2.13.6 Advisory →
- Fix · GHSA-vx8h-4prv-g744 github.com/rancher/rancher (Go) Fixed in 2.12.10 Advisory →
- Fix · GHSA-vx8h-4prv-g744 github.com/rancher/rancher (Go) Fixed in 0.0.0-20260513182521-2800aaac25b5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41052
- 2026-10-03 Alias added: GHSA-vx8h-4prv-g744
References
More SUSE Rancher vulnerabilities
- TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
- TI-2022-21489 Rancher: Non-random authentication token CVSS 3.1CRITICAL 9.8
- TI-2019-08380 An issue was discovered that affects the following versions of Rancher: v2.0.0 through… CVSS 3.0CRITICAL 9.8
- TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
- TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
- TI-2022-21491 Rancher: Exposure of sensitive fields CVSS 3.1CRITICAL 9.9
Sources
- CVE-2026-41052 · CVE Program
- CVE-2026-41052 · NVD
- FIRST EPSS
- GHSA-vx8h-4prv-g744 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences