Read the docs
TI-2026-32455 Aliases CVE-2026-44543GHSA-7fxv-8wr2-mfc4

Local Path Provisioner: HelperPod Template Injection

Priority MEDIUM 40CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269 and CWE-1336.

Summary

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by rancher/local-path-provisioner. The helperPod.yaml template is loaded by the provisioner and used to create HelperPods during PVC provisioning and cleanup operations. However, the template is not sufficiently validated before use. Security-sensitive fields such as securityContext.privileged, hostPath volumes, and Linux capabilities can be injected into the template. When a PVC operation triggers HelperPod creation, the provisioner creates the HelperPod using the attacker-controlled template. This can result in a privileged pod running on the target node with the host root filesystem mounted. This may allow the attacker to access sensitive host files, read ServiceAccount tokens from other pods on the same node, access other tenants' local-path volume data, or modify files on the host node. This vulnerability is fixed in 0.0.36.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0041 35th percentileScored 2026-11-07
Fix Fixed local-path-provisioner (rancher): 0.0.36github.com/rancher/local-path-provisioner (Go): 0.0.36

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Rancherlocal-path-provisionerbefore 0.0.360.0.36Patch availableCNA
—github.com/rancher/local-path-provisioner (Go)before 0.0.360.0.36Patch availableGHSA-7fxv-8wr2-mfc4
  • local-path-provisioner VendorRancher Affected before 0.0.36 Fixed in 0.0.36 Patch available CNA
  • github.com/rancher/local-path-provisioner (Go) Vendor— Affected before 0.0.36 Fixed in 0.0.36 Patch available GHSA-7fxv-8wr2-mfc4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:suse:local_path_provisioner:*:*:*:*:*:kubernetes:*:*before 0.0.36VulnerableSUSE
  • cpe:2.3:a:suse:local_path_provisioner:*:*:*:*:*:kubernetes:*:* Versions before 0.0.36 Vulnerable ·SUSE

Remediation

  • Fix · CNA local-path-provisioner (rancher) Fixed in 0.0.36
  • Fix · GHSA-7fxv-8wr2-mfc4 github.com/rancher/local-path-provisioner (Go) Fixed in 0.0.36 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44543
  2. 2026-10-03 Alias added: GHSA-7fxv-8wr2-mfc4

References

Advisory 2

Other 1

  • TI-2021-07559 Rancher: Cloud credentials can be used through proxy API by users without access CVSS 3.1CRITICAL 9.9
  • TI-2021-14897 Steve API proxy impersonation CVSS 3.1HIGH 8.8
  • TI-2021-14896 Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings CVSS 3.1HIGH 8.8
  • TI-2021-11979 Rancher: Privilege escalation vulnerability via malicious Connection header CVSS 3.1HIGH 8.8
  • TI-2021-07557 rancher: API group not properly specified when creating Kubernetes RBAC resources CVSS 3.1HIGH 8.8
  • TI-2026-40392 Long-lived Rancher registration token exposed in plaintext CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences