CVE-2026-44945

critical · 9.1

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

9.1

CVSS

0.4%

EPSS (exploit prob.)

32nd

EPSS percentile

2026-08-05

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-441CWE-497

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945
https://github.com/rancher/rancher/pull/55983
https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-44945