CVE-2026-44945

Cross-Cluster Impersonation Confused-Deputy Privilege Escalation

State: Published
Severity: 9.1 Critical
Published: Aug 5, 2026
Updated: Aug 6, 2026
Reserved: May 8, 2026

Description

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages.

This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	suse

Weaknesses

CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
CWE-497 Exposure of sensitive system information to an unauthorized control sphere

Affected Products

Product	Versions
RancherSUSE	2.11.0 to before 2.11.16Affectedfrom 2.11.16Not affected 2.12.0 to before 2.12.12Affectedfrom 2.12.12Not affected 2.13.0 to before 2.13.8Affectedfrom 2.13.8Not affected 2.14.0 to before 2.14.2Affectedfrom 2.14.4Not affected

References

https://github.com/rancher/rancher/pull/55983patch
https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpqvendor-advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.