# CVE-2026-44939: SUSE Rancher command injection in cluster import endpoint

Source: https://junglewise.ai/threats/cve-2026-44939-suse-rancher-command-injection-in-cluster-import-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-44939 · Severity: critical · CVSS 9.6 · Published 2026-06-19

A critical vulnerability in Rancher Manager allows attackers to inject malicious commands into the configuration files used to import new Kubernetes clusters. If an administrator uses a compromised import link, the attacker can gain full administrative control over the entire cluster, including access to sensitive data and the ability to disrupt operations. This occurs because the software fails to properly clean user-provided data before including it in the cluster setup instructions.

Technologies: [github.com/rancher/rancher (Go)](https://junglewise.ai/threats/technologies/github-com-rancher-rancher), [Suse Rancher](https://junglewise.ai/threats/technologies/rancher). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-44939 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44939 being exploited in the wild.

**How severe is CVE-2026-44939?** Critical severity, with a CVSS score of 9.6, published 19 June 2026.

**Which products and versions are affected?** github.com/rancher/rancher (Go) SEMVER:introduced=0,fixed=0.0.0-20260617231817-2aa77eb283e7, SEMVER:introduced=2.14.0,fixed=2.14.2; Suse Rancher >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6; >= 2.12.0, < 2.12.10; >= 2.11.0, < 2.11.14; >= 2.10.0, < 2.10.12, >=2.14.0, <2.14.2; >=2.13.0, <2.13.6; >=2.12.0, <2.12.10; >=2.11.0, <2.11.14; >=2.10.0, <2.10.12.

**Is there a fix for CVE-2026-44939?** Yes. github.com/rancher/rancher (Go): upgrade to 0.0.0-20260617231817-2aa77eb283e7, 2.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44939 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44939?** Check whether you run github.com/rancher/rancher (Go) or Suse Rancher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rancher/rancher (Go): upgrade to 0.0.0-20260617231817-2aa77eb283e7, 2.14.2 or later

  ```sh
  go get github.com/rancher/rancher@v2.14.2
  ```


## Technical details

A command injection vulnerability exists in the Rancher Manager cluster import endpoint `/v3/import/{token}_{clusterId}.yaml`. The `authImage` query parameter is rendered into a Kubernetes manifest template without proper sanitization. By using URL-encoded newlines, an attacker can break out of the `image:` YAML field to inject arbitrary keys, such as `command:`. Exploitation requires the attacker to obtain a valid cluster registration token and trick an administrator into running `kubectl apply` against the malicious URL. Successful exploitation deploys a privileged DaemonSet with `cluster-admin` rights, host network access, and host filesystem mounts on all control-plane nodes. Patches are available in versions 2.14.2, 2.13.6, 2.12.10, 2.11.14, and 2.10.12.

## Affected products

- SUSE Rancher Manager >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6; >= 2.12.0, < 2.12.10; >= 2.11.0, < 2.11.14; >= 2.10.0, < 2.10.12

## Identifiers

- CVE-2026-44939
- GHSA-mhc6-2gfq-xx62
- GO-2026-5875

## Timeline

- 2026-05-27: patched: Fixes committed to Rancher repository
- 2026-06-19: advisory: NVD publication date
- 2026-07-01: disclosed: GitHub Advisory published

## References

- [https://api.github.com/users/Ibonok](https://api.github.com/users/Ibonok)
- [https://github.com/Ibonok](https://github.com/Ibonok)
- [https://api.github.com/users/Ibonok/gists%7B/gist_id%7D](https://api.github.com/users/Ibonok/gists%7B/gist_id%7D)
- [https://api.github.com/users/Ibonok/repos](https://api.github.com/users/Ibonok/repos)
- [https://avatars.githubusercontent.com/u/37837775?v=4](https://avatars.githubusercontent.com/u/37837775?v=4)
- [https://api.github.com/users/Ibonok/events%7B/privacy%7D](https://api.github.com/users/Ibonok/events%7B/privacy%7D)

## Related threats

- [SUSE Rancher privilege escalation in GlobalRole RBAC](https://junglewise.ai/threats/cve-2026-88810-a-privilege-escalation-issue-was-discovered-in-rancher-manager-s)
- [Rancher privilege escalation via project name collision](https://junglewise.ai/threats/cve-2024-22031-rancher-users-who-can-create-projects-can-gain-access-to)
- [SUSE Rancher Fleet privilege escalation in resource deployment](https://junglewise.ai/threats/cve-2026-88808-a-vulnerability-has-been-identified-within-rancher-manager-where)
- [SUSE Rancher session revocation bypass on logout](https://junglewise.ai/threats/cve-2026-88805-incorrect-credential-cleaning-on-logout-could-be-used-by-remote)
- [SUSE Rancher stored cross-site scripting in public UI settings](https://junglewise.ai/threats/cve-2026-88804-an-unauthenticated-update-of-public-ui-settings-could-be-used-by)