CVE-2026-44939
A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.
- CVSS 4.0
- 9.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-25)
- CWE
- CWE-95
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mhc6-2gfq-xx62 | Go | github.com/rancher/rancher | >=2.14.0 <2.14.2 | 2.14.2 |
| GHSA-mhc6-2gfq-xx62 | Go | github.com/rancher/rancher | >=2.13.0 <2.13.6 | 2.13.6 |
| GHSA-mhc6-2gfq-xx62 | Go | github.com/rancher/rancher | >=2.12.0 <2.12.10 | 2.12.10 |
| GHSA-mhc6-2gfq-xx62 | Go | github.com/rancher/rancher | >=2.11.0 <2.11.14 | 2.11.14 |
| GHSA-mhc6-2gfq-xx62 | Go | github.com/rancher/rancher | >=2.10.0 <2.10.12 | 2.10.12 |
| GHSA-mhc6-2gfq-xx62 | Go | github.com/rancher/rancher | <0.0.0-20260617231817-2aa77eb283e7 | 0.0.0-20260617231817-2aa77eb283e7 |
| GO-2026-5875 | Go | github.com/rancher/rancher | <0.0.0-20260617231817-2aa77eb283e7 | 0.0.0-20260617231817-2aa77eb283e7 |