critical8.4
CVE-2026-41052
Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, …
Impact
Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/rancher/rancher | >= 2.14.0, < 2.14.2 | 2.14.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Suse | Rancher | from 2.12.0 before 2.12.10 from 2.13.0 before 2.13.6 from 2.14.0 before 2.14.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-vx8h-4prv-g744
- https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744
- https://nvd.nist.gov/vuln/detail/CVE-2026-41052
- https://github.com/rancher/rancher/pull/55061
- https://github.com/rancher/rancher/commit/2800aaac25b5a2c448f800e1f46d