CVE-2026-44945

Name of the Vulnerable Software and Affected Versions Rancher versions 2.11.0 through 2.11.15 Rancher versions 2.12.0 through 2.12.11 Rancher versions 2.13.0 through 2.13.7 Rancher versions 2.14.0 through 2.14.1

Description A privilege escalation issue exists in the impersonation middleware located in pkg/auth/requests/impersonate.go. An authenticated user assigned the default user global role can obtain full administrative access to the Rancher control plane and all managed downstream clusters.

Recommendations Update Rancher versions 2.11.0 through 2.11.15 to 2.11.16. Update Rancher versions 2.12.0 through 2.12.11 to 2.12.12. Update Rancher versions 2.13.0 through 2.13.7 to 2.13.8. Update Rancher versions 2.14.0 through 2.14.1 to 2.14.2.