CVE-2026-44949 Details

A vulnerability exists in the Rancher FleetWorkspace admission process within the webhook handler. It affects Rancher Webhook versions 0.7.0 prior to 0.7.10, 0.8.0 prior to 0.8.7, 0.9.0 prior to 0.9.6, and 0.10.0 prior to 0.10.7. An unauthenticated attacker with network access to the in-cluster rancher-webhook service could send a crafted admission payload, leading to the creation of workspace-related Kubernetes objects with attacker-chosen identity data. This exploitation could cause unauthorized integrity changes in Fleet workspace role-based access control (RBAC) for newly created workspaces.

Users can upgrade to Rancher Webhook versions 0.10.7, 0.9.6, 0.8.7, or 0.7.10. The fix is included in Rancher releases 2.14.3, 2.13.7, 2.12.11, and 2.11.15. For more information, consult the Rancher webhook hardening guide and reach out to the SUSE Rancher Security team for security-related inquiries.