CVE-2026-41052

High

Description

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.

SeverityHigh

CVSS8.8

Exploit probability37. percentile0.4%

Product

Suse Rancher

PublishedJun 29, 2026

First seenJun 29, 2026

Weakness typeCWE-305CWE-305

How to fix

Update

suse rancher2.12.10, 2.13.6, 2.14.2 or later
github.com/rancher/rancher2.14.2, 2.13.6, 2.12.10, 0.0.0-20260513182521-2800aaac25b5 or later

Vendor advisories

github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744

Affected products

Product	Affected versions	Fixed in
suse rancher	2.12.0 ≤ v < 2.12.10, 2.13.0 ≤ v < 2.13.6, 2.14.0 ≤ v < 2.14.2	2.12.10, 2.13.6, 2.14.2
github.com/rancher/rancherGo	2.14.0 ≤ v < 2.14.2, 2.13.0 ≤ v < 2.13.6, 2.12.0 ≤ v < 2.12.10, v < 0.0.0-20260513182521-2800aaac25b5	2.14.2, 2.13.6, 2.12.10, 0.0.0-20260513182521-2800aaac25b5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.