CVE-2026-41052

critical · 9.4

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.

9.4

CVSS

0.4%

EPSS (exploit prob.)

36th

EPSS percentile

2026-06-29

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-305

Affected products

Vendor	Product	Affected versions
suse	rancher	>= 2.12.0, < 2.12.10
suse	rancher	>= 2.13.0, < 2.13.6
suse	rancher	>= 2.14.0, < 2.14.2

Check a specific version with /api/v1/cve/match.

References

https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-41052