Is CVE-2026-41053 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41053 being exploited in the wild.

How severe is CVE-2026-41053?

High severity, with a CVSS score of 8.8, published 30 June 2026.

Which products and versions are affected?

github.com/rancher/rancher (Go) SEMVER:introduced=0,fixed=0.0.0-20260519172014-d0c047bbc6d2, SEMVER:introduced=2.14.0,fixed=2.14.2; Suse Rancher >=2.13.0, =2.14.0, = 2.14.0, = 2.13.0, < 2.13.6.

Is there a fix for CVE-2026-41053?

Yes. github.com/rancher/rancher (Go): upgrade to 0.0.0-20260519172014-d0c047bbc6d2, 2.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41053 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-41053?

Check whether you run github.com/rancher/rancher (Go), Suse Rancher or Suse Rancher Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41053: SUSE Rancher privilege escalation in GitHub App authentication provider

Q: Is there a fix for CVE-2026-41053?

Yes. github.com/rancher/rancher (Go): upgrade to 0.0.0-20260519172014-d0c047bbc6d2, 2.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-41053 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-41053?

Check whether you run github.com/rancher/rancher (Go), Suse Rancher or Suse Rancher Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41053 · Severity: high · CVSS 8.8 · Published 2026-06-30

A security flaw in Rancher Manager's GitHub App authentication provider allows users to inherit permissions they were never granted. If a user belongs to just one team within a GitHub organization, Rancher may mistakenly grant them the access rights of every other team in that same organization. This could allow a low-privileged user to gain administrative control over clusters or access sensitive project data they should not be able to see.

Technologies: github.com/rancher/rancher (Go), Suse Rancher, Suse Rancher Manager. Vendors: Go, Suse.

Quick answers

Is CVE-2026-41053 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41053 being exploited in the wild.
How severe is CVE-2026-41053?: High severity, with a CVSS score of 8.8, published 30 June 2026.
Which products and versions are affected?: github.com/rancher/rancher (Go) SEMVER:introduced=0,fixed=0.0.0-20260519172014-d0c047bbc6d2, SEMVER:introduced=2.14.0,fixed=2.14.2; Suse Rancher >=2.13.0, <2.13.6; >=2.14.0, <2.14.2; Suse Rancher Manager >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6.
Is there a fix for CVE-2026-41053?: Yes. github.com/rancher/rancher (Go): upgrade to 0.0.0-20260519172014-d0c047bbc6d2, 2.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41053 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41053?: Check whether you run github.com/rancher/rancher (Go), Suse Rancher or Suse Rancher Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/rancher/rancher (Go): upgrade to 0.0.0-20260519172014-d0c047bbc6d2, 2.14.2 or later
```
go get github.com/rancher/rancher@v2.14.2
```

Technical details

An incorrect implementation of the authentication algorithm (CWE-303) exists in Rancher's GitHub App authentication provider. When evaluating group principals, the logic incorrectly iterates over all teams in the associated GitHub organization instead of the user-specific membership list due to improper handling of cached data. An attacker with a valid GitHub account and membership in at least one team can bypass Role-Based Access Control (RBAC) and login allowlists. This allows the attacker to inherit permissions from any other team in the organization that has been mapped to Rancher roles. Patches are available in versions 2.14.2 and 2.13.6.

Affected products

SUSE Rancher Manager >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6

Identifiers

CVE-2026-41053
GHSA-4j6x-2764-m8gh
GO-2026-5869

Timeline

2026-05-27: disclosed
2026-06-30: advisory: NVD publication date
2026-07-01: advisory: GitHub Advisory reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.