Command injection via unsanitized YAML parameter in Rancher Manager (CVE-2026-44939)

A command injection vulnerability in the Rancher Manager cluster import endpoint `/v3/import/{token}_{clusterId}.yaml` allows a remote attacker to inject arbitrary YAML keys into a generated Kubernetes manifest by including URL-encoded newlines in the `authImage` query parameter. Successful exploitation - requiring a valid cluster registration token and a victim operator applying a crafted manifest - can result in full control over downstream Kubernetes clusters, arbitrary code execution on control-plane nodes with elevated privileges, and persistent access via a deployed DaemonSet. Affected versions: - >=2.14.0, <2.14.2 - >=2.13.0, <2.13.6 - >=2.12.0, <2.12.10 - >=2.11.0, <2.11.14 - >=2.10.0, <2.10.12 We recommend updating to: 2.14.2, 2.13.6, 2.12.10, 2.11.14, 2.10.12. CVSS 9.4 · our assessment: act_now Reference: https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62 Details: https://vuln.today/cve/CVE-2026-44939