CVE-2026-44945 Details

A privilege escalation vulnerability has been identified in Rancher's impersonation middleware, specifically in versions 2.11.0 prior to 2.11.16, 2.12.0 prior to 2.12.12, 2.13.0 prior to 2.13.8, and 2.14.0 prior to 2.14.2. This vulnerability allows an authenticated user with the default 'user' global role to gain full administrative access to the Rancher control plane and all downstream clusters it manages. The issue arises because the impersonation middleware authorizes requests by running a Kubernetes 'SubjectAccessReview' against a cluster derived from the request URL, but the actual request is executed via Rancher's management API, which targets the local Rancher management cluster. This discrepancy allows an attacker with RBAC control on any downstream cluster to impersonate privileged identities, including 'system:masters', on the local Rancher cluster. Exploitation of this vulnerability enables access to all secrets stored by Rancher, modification of 'GlobalRoleBindings', and complete administrative control over all clusters managed by the affected Rancher instance.

Users can upgrade to Rancher versions 2.14.4, 2.13.8, 2.12.12, or 2.11.16 to address this vulnerability. For organizations unable to upgrade immediately, it is recommended to audit and restrict which users can register downstream clusters in Rancher, as the default permission allows any user with the 'user' global role to import clusters.