Reported by 2 outlets
Critical Rancher Flaw Lets Authenticated Users Take Over All Managed Kubernetes Clusters
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 4.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Critical Rancher Flaw Lets Authenticated Users Take Over All Managed Kubernetes Clusters
cyberpress.org · 63d ago · August 11th, 2026
SUSE has fixed a critical privilege-escalation vulnerability in Rancher that could allow a low-privileged authenticated user to seize administrative control of the Rancher management plane and every downstream Kubernetes cluster it manages. Tracked as CVE-2026-44945 and GitHub advisory GHSA-v584-7w32-jwpq, the issue carries a CVSS v3.1 score of 9.1 and is classified as CWE-441, or an unintended proxy/confused-deputy weakness. The flaw resides in Rancher’s impersonation middleware , specifically pkg/auth/requests/impersonate.go . Rancher supports Kubernetes API impersonation by processing headers such as Impersonate-User , Impersonate-Group , and Impersonate-Extra-* . Critical Rancher Flaw However, the vulnerable implementation checked authorization in one Kubernetes cluster while ultimately sending the request to another: Rancher’s local management cluster. This creates a cross-cluster authorization mismatch. When a request arrived, Rancher parsed a cluster identifier from the URL and performed a Kubernetes SubjectAccessReview (SAR) against that specified downstream cluster. The request was then handled by Rancher’s management API, which uses the privileged scaledContext service account to operate against the local Rancher cluster. The Norman proxy store forwarded impersonation headers to that local Kubernetes API. An attacker could therefore control the authorization decision by choosing a downstream cluster where they hold RBAC privileges, while directing the effective acti
-
update from gbhackers.com
Critical Rancher Flaw Lets Authenticated Users Gain Full Admin Access to All Managed Clusters
gbhackers.com · 63d ago · August 11th, 2026
Rancher has […] The post Critical Rancher Flaw Lets Authenticated Users Gain Full Admin Access to All Managed Clusters appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .