8.8 HighCWE-303
CVE-2026-41053
Over-inclusive team membership expansion in GitHub App authentication provider for Rancher
SUSERancher
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.5%probability of exploitation in the next 30 days
Higher than 44% of scored CVEs
SeverityCVSS
8.8High
Description NVD
Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.
Coverage 1 article · 1 outlet
- Rancher CVE-2026-44939 lets attackers hijack Kubernetes clustersSecurityOnline · first in our coverage · mentions it in passing