high8.8
CVE-2026-41053
Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any log…
Impact
Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/rancher/rancher | >= 2.14.0, < 2.14.2 | 2.14.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Suse | Rancher | from 2.13.0 before 2.13.6 from 2.14.0 before 2.14.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-4j6x-2764-m8gh
- https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh
- https://nvd.nist.gov/vuln/detail/CVE-2026-41053
- https://github.com/rancher/rancher/pull/55093
- https://github.com/rancher/rancher/pull/55147
- https://github.com/rancher/rancher/commit/361d4d57cd09b87f3c53f88af42046ffaa7b57e4
- https://github.com/rancher/rancher/commit/d0c047bbc6d202e953d7557b82cbb354367db6ae