CVE-2026-44939 Details

A command injection vulnerability exists in Rancher Manager clusters running versions 2.14.0 prior to 2.14.2, 2.13.0 prior to 2.13.6, 2.12.0 prior to 2.12.10, 2.11.0 prior to 2.11.14, and 2.10.0 prior to 2.10.12. The vulnerability arises from unsanitized YAML parameters in the import endpoint `/v3/import/{token}_{clusterId}.yaml`. This flaw allows remote attackers to inject arbitrary YAML keys and execute malicious containers by breaking out of the `image:` field in the generated Kubernetes manifest template.

Users can upgrade to Rancher versions 2.14.2, 2.13.6, 2.12.10, 2.11.14, or 2.10.12 to address this vulnerability. If an immediate upgrade is not possible, users are advised to review the `kube-api-auth` DaemonSet in downstream clusters for any signs of exploitation, such as unexpected `command:` or `args:` fields in the container specification, references to suspicious container images, or modifications occurring after the initial cluster import. Before applying any import manifests, it's important to verify that the source URLs are from trusted sources and match expected patterns.