CVE-2026-41052 Details

A vulnerability exists in Rancher versions 2.14 prior to 2.14.2, 2.13 prior to 2.13.6, and 2.12 prior to 2.12.10. It allows users with the Project Owner role to escalate privileges by modifying Pod Security Admission (PSA) labels on namespaces within their projects. This can be exploited by users with Cluster Member access who create or are assigned to a project, then create a namespace and change the PSA configuration to the privileged profile. This exploitation enables the deployment of privileged workloads, bypassing standard Kubernetes security measures and potentially leading to unauthorized access to host resources or escalation of privileges within the cluster.

Users can upgrade to Rancher versions 2.14.2, 2.13.6, or 2.12.10, where this vulnerability is patched. If an immediate upgrade is not possible, administrators can create a custom project role based on the existing Project Owner role, removing unrestricted wildcard permissions for project resources. The allowed verbs should be restricted to 'get', 'update', 'delete', 'patch', 'create', 'list', 'watch', and 'deletecollection', instead of using the wildcard '*'. This adjustment prevents access to the 'updatepsa' capability, which is responsible for the privilege escalation.