CVE-2026-44939: SUSE Rancher command injection in cluster import endpoint

CVE-2026-44939 · Severity: critical · CVSS 9.6 · Published 2026-06-19

A critical vulnerability in Rancher Manager allows attackers to inject malicious commands into the configuration files used to import new Kubernetes clusters. If an administrator uses a compromised import link, the attacker can gain full administrative control over the entire cluster, including access to sensitive data and the ability to disrupt operations. This occurs because the software fails to properly clean user-provided data before including it in the cluster setup instructions.

Technologies: github.com/rancher/rancher (Go), Suse Rancher. Vendors: Go, Suse.

Quick answers

Is CVE-2026-44939 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44939 being exploited in the wild.
How severe is CVE-2026-44939?
Critical severity, with a CVSS score of 9.6, published 19 June 2026.
Which products and versions are affected?
github.com/rancher/rancher (Go) SEMVER:introduced=0,fixed=0.0.0-20260617231817-2aa77eb283e7, SEMVER:introduced=2.14.0,fixed=2.14.2; Suse Rancher >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6; >= 2.12.0, < 2.12.10; >= 2.11.0, < 2.11.14; >= 2.10.0, < 2.10.12, >=2.14.0, <2.14.2; >=2.13.0, <2.13.6; >=2.12.0, <2.12.10; >=2.11.0, <2.11.14; >=2.10.0, <2.10.12.
Is there a fix for CVE-2026-44939?
Yes. github.com/rancher/rancher (Go): upgrade to 0.0.0-20260617231817-2aa77eb283e7, 2.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44939 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44939?
Check whether you run github.com/rancher/rancher (Go) or Suse Rancher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/rancher/rancher (Go): upgrade to 0.0.0-20260617231817-2aa77eb283e7, 2.14.2 or later
    go get github.com/rancher/rancher@v2.14.2

Technical details

A command injection vulnerability exists in the Rancher Manager cluster import endpoint `/v3/import/{token}_{clusterId}.yaml`. The `authImage` query parameter is rendered into a Kubernetes manifest template without proper sanitization. By using URL-encoded newlines, an attacker can break out of the `image:` YAML field to inject arbitrary keys, such as `command:`. Exploitation requires the attacker to obtain a valid cluster registration token and trick an administrator into running `kubectl apply` against the malicious URL. Successful exploitation deploys a privileged DaemonSet with `cluster-admin` rights, host network access, and host filesystem mounts on all control-plane nodes. Patches are available in versions 2.14.2, 2.13.6, 2.12.10, 2.11.14, and 2.10.12.

Affected products

  • SUSE Rancher Manager >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6; >= 2.12.0, < 2.12.10; >= 2.11.0, < 2.11.14; >= 2.10.0, < 2.10.12

Identifiers

  • CVE-2026-44939
  • GHSA-mhc6-2gfq-xx62
  • GO-2026-5875

Timeline

  • 2026-05-27: patched: Fixes committed to Rancher repository
  • 2026-06-19: advisory: NVD publication date
  • 2026-07-01: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.