CVE-2026-41052: Rancher Privilege Escalation from Project Owner to Host
Analyzed
AliasesGHSA-vx8h-4prv-g744GO-2026-5876CGA-89fh-gx7h-g5wjCGA-c4r4-j9m4-4gm8CGA-ccqj-v8v6-vhc2CGA-f7m9-xcmq-9v2mCGA-m4rm-hpf9-3xxrCGA-m68j-xgq2-99h6CGA-r2rv-9wgh-5grfCGA-w829-hrf5-pm7m
Published 29-06-2026Last modified 30-06-2026
Vulnerability summary
CVE-2026-41052 is a critical (CVSS 9.4) vulnerability in suse rancher. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.5% of scored vulnerabilities.
CVSS score
9.4/10
010
Critical · v4.0 (CVE.org)EPSS score
0.42%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 29-06-2026PublishedVulnerability first disclosed.
- 30-06-2026Last modifiedVulnerability information updated.
Description
Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.
CVSS metrics
6 scores · 4 sources · 2 versionsCritical 9.4Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HSourcesAll 4 agree
- OSV · GoEcosystem advisory · calculated9.4CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- OSV · ChainguardEcosystem advisory · calculated9.4CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- NVDNIST9.4CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 8.4Preferred score · OSV · Go (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HSources2 sources · 8.4–8.8
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.42% on 22-09-2026
22-09-202622-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- harvester< 1.8.1-r32
- harvester-fips< 1.8.1-r29
- harvester-fips-webhook< 1.8.1-r28
- harvester-webhook< 1.8.1-r32
Github.com/rancher1 product
- rancher≥ 2.14.0, < 2.14.2 | ≥ 2.13.0, < 2.13.6 | ≥ 2.12.0, < 2.12.10 | < 0.0.0-20260513182521-2800aaac25b5
Suse1 product
- rancher≥ 2.12.0, < 2.12.10 | ≥ 2.13.0, < 2.13.6 | ≥ 2.14.0, < 2.14.2
3 vendors · 6 products
References
7 links
- github.com/rancher/rancherPACKAGE