CVE-2026-44945

Last refreshed2026-10-23

Status: UPDATED | Advisory ID: CVE-2026-44945

Key Details

CVE	CVE-2026-44945
CVSS Score / Version	9.1 (Critical) / CVSS v3.1
Updated	2026-10-23
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is high; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	suse Rancher
Classified as	CWE-441 (Unintended Proxy or Intermediary ('Confused Deputy'))

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
suse	Rancher

Vendor

Product

Affected Versions

Patch Status

suse

Rancher

Subsystems	General OT
Sectors	Multiple

What to Know

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user

global role can gain full administrative access to the Rancher control

plane and transitively to all downstream clusters it manages.

This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2. (NVD)

What to Do

Monitor suse's web page for any future patch releases.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-44945
CVE	https://www.cve.org/CVERecord?id=CVE-2026-44945

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-44945

CVE

https://www.cve.org/CVERecord?id=CVE-2026-44945