CVE-2026-44939

Command injection through unsanitized YAML parameter in Rancher

State: Published
Severity: 9.4 Critical
Published: Jun 19, 2026
Updated: Jun 24, 2026
Reserved: May 8, 2026

Description

A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	suse

Weaknesses

CWE-95 Improper neutralization of directives in dynamically evaluated code ('eval injection')

Affected Products

Product	Versions
RancherSUSE	2.14.0 to before 2.14.2Affected 2.13.0 to before 2.13.6Affected 2.12.0 to before 2.12.10Affected 2.11.0 to before 2.11.14Affected 2.10.0 to before 2.10.12Affected

References

https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.