CVE-2026-44945: Rancher Privilege Escalation Vulnerability

CVE-2026-44945 Overview

CVE-2026-44945 is a privilege escalation vulnerability in Rancher's impersonation middleware located in pkg/auth/requests/impersonate.go. An authenticated Rancher user assigned the default user global role can elevate to full administrative access over the Rancher control plane. This access transitively extends to every downstream Kubernetes cluster managed by the Rancher instance. The flaw is classified under CWE-441 (Unintended Proxy or Intermediary). Affected releases span the 2.11.x, 2.12.x, 2.13.x, and 2.14.x branches of Rancher prior to the fixed versions.

Critical Impact
A low-privilege authenticated user can obtain administrative control of Rancher and all downstream clusters, resulting in full cluster compromise.

Affected Products

Rancher 2.11.0 through 2.11.15
Rancher 2.12.0 through 2.12.11
Rancher 2.13.0 through 2.13.7
Rancher 2.14.0 through 2.14.1

Discovery Timeline

2026-08-05 - CVE-2026-44945 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-44945

Vulnerability Analysis

Rancher acts as a management proxy that authenticates users and then impersonates them against downstream Kubernetes API servers. The impersonation middleware in pkg/auth/requests/impersonate.go is responsible for translating an authenticated Rancher identity into Kubernetes impersonation headers such as Impersonate-User, Impersonate-Group, and Impersonate-Extra. When this translation fails to strictly validate the caller's global role and requested impersonation targets, an authenticated user can request impersonation of privileged identities.

An attacker holding only the default user global role can craft requests that cause the middleware to attach elevated impersonation headers. The Rancher API server then executes those requests with administrative privileges. Because Rancher fans requests out to every managed downstream cluster, the escalation propagates from the control plane to workload clusters.

Root Cause

The root cause is insufficient authorization enforcement inside the impersonation middleware, categorized under CWE-441 as an unintended proxy behavior. The middleware trusts client-supplied impersonation intent without verifying that the authenticated principal is authorized to assume the requested identity or groups. Fixed builds tighten this validation as described in Rancher pull request #55983.

Attack Vector

Exploitation requires network reachability to the Rancher API and valid credentials with the default user global role. No user interaction is required. The scope is changed because the vulnerable component crosses a trust boundary into downstream clusters. Refer to the GitHub Security Advisory GHSA-v584-7w32-jwpq for the vendor's technical description. No public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-44945

Indicators of Compromise

Rancher audit log entries showing standard users issuing requests that resolve to admin or cluster-admin bound actions
API requests containing Impersonate-User, Impersonate-Group, or Impersonate-Extra headers originating from non-administrative accounts
Unexpected creation of ClusterRoleBindings, GlobalRoleBindings, or service accounts in downstream clusters
Sudden appearance of new kubeconfig tokens or API keys tied to low-privilege Rancher users

Detection Strategies

Enable Rancher API audit logging at level RequestResponse and alert on impersonation header use by non-admin principals
Correlate Rancher user identity with downstream Kubernetes audit.k8s.io events to detect privilege mismatches
Baseline expected administrative actions per user and flag deviations, particularly writes to management.cattle.io resources

Monitoring Recommendations

Forward Rancher and Kubernetes audit logs to a centralized analytics platform for retention and correlation
Monitor changes to GlobalRole, GlobalRoleBinding, ClusterRoleTemplateBinding, and Token resources
Track authentication events from Rancher for unusual session activity or token issuance patterns

How to Mitigate CVE-2026-44945

Immediate Actions Required

Upgrade Rancher to a fixed release: 2.11.16, 2.12.12, 2.13.8, or 2.14.2 or later
Rotate all Rancher API tokens and downstream cluster kubeconfig credentials after patching
Audit GlobalRoleBinding and ClusterRoleTemplateBinding resources for unauthorized elevations created before the patch
Restrict network access to the Rancher API to trusted management networks

Patch Information

SUSE has released fixed builds tracked in the SUSE Bug Report for CVE-2026-44945. The code fix is documented in Rancher Pull Request #55983 and coordinated through GitHub Security Advisory GHSA-v584-7w32-jwpq. Upgrade to Rancher 2.11.16, 2.12.12, 2.13.8, or 2.14.2 depending on the branch in use.

Workarounds

If immediate patching is not possible, review and remove the default user global role from accounts that do not require Rancher API access
Limit account provisioning and disable self-service registration until upgrade is complete
Place the Rancher management endpoint behind a VPN or zero-trust proxy to reduce the authenticated attack surface

bash

# Verify the running Rancher version and plan upgrade
kubectl -n cattle-system get deploy rancher -o jsonpath='{.spec.template.spec.containers[0].image}'

# Upgrade via Helm to a fixed release (example for the 2.14 branch)
helm repo update
helm upgrade rancher rancher-stable/rancher \
  --namespace cattle-system \
  --version 2.14.2

# Audit for suspicious GlobalRoleBindings created by non-admin users
kubectl get globalrolebindings.management.cattle.io -o json \
  | jq '.items[] | select(.globalRoleName=="admin") | {name:.metadata.name, user:.userName, created:.metadata.creationTimestamp}'