by Kastro
Paper/Archive/CVE-2026-41052

CVE-2026-41052

SUSE Rancher — Rancher Privilege Escalation from Project Owner to Host

EPSS 0.4%CVSS 9.4
critical.is priorityof 100
36
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 36.7.367 × 207.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.

Affected

ProductAffectedFixed inSource
Rancher2.12.0 – < 2.12.102.12.10CNA
Rancher2.13.0 – < 2.13.62.13.6CNA
Rancher2.14.0 – < 2.14.22.14.2CNA

Scores by source

suse (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorygithub.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744