CVE-2026-41053
Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.
- CVSS 3.1
- 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-25)
- CWE
- CWE-303
- Published
- Modified
- Record from
- the NVD, synced
Affected
- suse:rancher
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4j6x-2764-m8gh | Go | github.com/rancher/rancher | >=2.14.0 <2.14.2 | 2.14.2 |
| GHSA-4j6x-2764-m8gh | Go | github.com/rancher/rancher | >=2.13.0 <2.13.6 | 2.13.6 |
| GHSA-4j6x-2764-m8gh | Go | github.com/rancher/rancher | <0.0.0-20260519172014-d0c047bbc6d2 | 0.0.0-20260519172014-d0c047bbc6d2 |
| GO-2026-5869 | Go | github.com/rancher/rancher | <0.0.0-20260519172014-d0c047bbc6d2 | 0.0.0-20260519172014-d0c047bbc6d2 |