# CVE-2026-44947: SUSE Rancher improper preservation of permissions in PRTB reconciler

Source: https://junglewise.ai/threats/cve-2026-44947-suse-rancher-improper-preservation-of-permissions-in-prtb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-44947 · Severity: info · CVSS 6.9 · Published 2026-06-30

Rancher is a popular platform for managing Kubernetes clusters. A flaw in how it handles user permissions means that when an administrator tries to revoke a user's ability to change security settings (Pod Security Admissions), those permissions may fail to actually be removed. This allows a user to maintain unauthorized control over security policies within a project even after their access was supposedly restricted.

Technologies: [Suse Rancher](https://junglewise.ai/threats/technologies/rancher). Vendors: [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-44947 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44947 being exploited in the wild.

**How severe is CVE-2026-44947?** Informational severity, with a CVSS score of 6.9, published 30 June 2026.

**Which products and versions are affected?** Suse Rancher 2.13.0 to 2.13.6, 2.14.0 to 2.14.2.

**Is there a fix for CVE-2026-44947?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44947 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44947?** Check whether you run Suse Rancher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the legacy Project Role Template Binding (PRTB) reconciler in Rancher (specifically when the 'aggregated-roletemplates' feature flag is disabled). The root cause is a missing clean-up path in the 'ensurePSAPermissions()' function within 'pkg/controllers/managementuser/rbac/prtb_handler.go'. When an administrator removes the 'updatepsa' permission from a RoleTemplate, the reconciler fails to delete the associated PSA ClusterRole and ClusterRoleBinding. An attacker with high privileges (already possessing the initial permission) can exploit this to retain persistent, unauthorized access to modify PSA enforcement levels across project namespaces. The issue is fixed in Rancher versions 2.14.3 and 2.13.7.

## Affected products

- SUSE Rancher 2.13.0 to 2.13.6, 2.14.0 to 2.14.2

## Timeline

- 2026-06-29: advisory: GitHub advisory published by Rancher team
- 2026-06-30: disclosed: NVD publication date

## References

- [https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc](https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc)

## Related threats

- [SUSE Rancher privilege escalation in GlobalRole RBAC](https://junglewise.ai/threats/cve-2026-88810-a-privilege-escalation-issue-was-discovered-in-rancher-manager-s)
- [Rancher privilege escalation via project name collision](https://junglewise.ai/threats/cve-2024-22031-rancher-users-who-can-create-projects-can-gain-access-to)
- [SUSE Rancher Fleet privilege escalation in resource deployment](https://junglewise.ai/threats/cve-2026-88808-a-vulnerability-has-been-identified-within-rancher-manager-where)
- [SUSE Rancher session revocation bypass on logout](https://junglewise.ai/threats/cve-2026-88805-incorrect-credential-cleaning-on-logout-could-be-used-by-remote)
- [SUSE Rancher stored cross-site scripting in public UI settings](https://junglewise.ai/threats/cve-2026-88804-an-unauthenticated-update-of-public-ui-settings-could-be-used-by)