CVE-2026-44543 Details
Description
Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by rancher/local-path-provisioner. The helperPod.yaml template is loaded by the provisioner and used to create HelperPods during PVC provisioning and cleanup operations. However, the template is not sufficiently validated before use. Security-sensitive fields such as securityContext.privileged, hostPath volumes, and Linux capabilities can be injected into the template. When a PVC operation triggers HelperPod creation, the provisioner creates the HelperPod using the attacker-controlled template. This can result in a privileged pod running on the target node with the host root filesystem mounted. This may allow the attacker to access sensitive host files, read ServiceAccount tokens from other pods on the same node, access other tenants' local-path volume data, or modify files on the host node. This vulnerability is fixed in 0.0.36.
A vulnerability exists in Rancher Local Path Provisioner versions prior to 0.0.36, allowing a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace to manipulate the helperPod.yaml template. This template, used to create HelperPods during Persistent Volume Claim (PVC) operations, lacks proper validation, enabling the injection of security-sensitive fields such as privileged security contexts, hostPath volumes, and Linux capabilities. Exploiting this flaw can lead to the creation of a privileged pod on the target node, with the host root filesystem mounted, potentially allowing access to sensitive host files, ServiceAccount tokens from other pods, local-path volume data from other tenants, or modification of files on the host node.
Users should upgrade to Rancher Local Path Provisioner version 0.0.36 or later. As a temporary mitigation, restrict write access to the local-path-config ConfigMap in the local-path-storage namespace, allowing only trusted administrators to make updates. After deployment, the ConfigMap can be marked as immutable. Additionally, enabling Kubernetes Pod Security Admission for the local-path-storage namespace can prevent privileged HelperPods from being created, providing an extra layer of defense.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rancher/local-path-provisioner/security/advisories/GHSA-7fxv-8wr2-mfc4 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| suse local path provisioner | < 0.0.36 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |