Which versions of Rancher are affected by CVE-2026-41052?

SUSE Rancher (versions 2.12-2.14) contains a critical privilege escalation vulnerability (CVE-2026-41052, CVSS 9.4) that allows Project Owners to bypass authorization controls and escalate privileges…. A patch is available.

How to fix or mitigate CVE-2026-41052?

24 hours: Inventory all SUSE Rancher deployments and identify instances running affected versions (2.12.0-2.12.9, 2.13.0-2.13.5, 2.14.0-2.14.1). Audit and document all active Project Owner role assignments and administrative access patterns. 7 days: Implement compensating controls-restrict Project Owner role to minimal personnel, enforce multi-factor authentication for Project Owner accounts, and deploy enhanced monitoring for Project Owner activity and privilege escalation attempts. 30 days: Monitor vendor advisory GHSA-vx8h-4prv-g744 for patch availability; conduct security review of all cluster RBAC policies and Kubernetes access controls; prepare upgrade plan contingent on patch release.

Rancher CVE-2026-41052

Q: What is the CVSS score of CVE-2026-41052?

CVE-2026-41052 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40130 CRITICAL

Authentication Bypass by Primary Weakness (CWE-305)

2026-06-29 suse

GHSA-vx8h-4prv-g744

Privilege Escalation Rancher Suse

9.4

CVSS 4.0 · Vendor: suse

Severity by source

Vendor (suse) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Requires an authenticated but only project-scoped Project Owner role (PR:L not PR:H), escalation crosses the authorization boundary into the cluster (S:C), yielding full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 29, 2026 - 18:01 EUVD

Analysis Generated

Jun 29, 2026 - 16:32 vuln.today

DescriptionCVE.org

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.

AnalysisAI

Privilege escalation in SUSE Rancher (Kubernetes management platform) allows a user holding the Project Owner role to improperly escalate their privileges beyond their assigned project scope, per advisory GHSA-vx8h-4prv-g744. Affected releases are 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10. There is no public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.4 and scope-changing impact mean a successful escalation can compromise cluster-wide confidentiality, integrity, and availability.

Technical ContextAI

Rancher is a multi-cluster Kubernetes management platform that implements its own RBAC layer on top of Kubernetes, granting delegated roles such as Cluster Owner, Project Owner, and Project Member. The flaw is classified as CWE-305 (authentication/authorization bypass by primary weakness) and tagged as Privilege Escalation, stemming from improper privilege handling in how Rancher enforces the boundaries of the Project Owner role. Because Rancher mediates access to underlying cluster resources, a defect in this authorization logic lets a project-scoped principal act outside its intended namespace/project boundary. The single affected CPE is cpe:2.3:a:suse:rancher, confirming the Rancher application itself (not a downstream distribution component) is the vulnerable surface.

RemediationAI

Vendor-released patch: upgrade to Rancher 2.14.2, 2.13.6, or 2.12.10 (or later) depending on your current minor branch, as documented in advisory https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744. Until you can upgrade, reduce exposure by minimizing who holds the Project Owner role: audit existing Project Owner bindings and revoke any that are unnecessary, and restrict granting of that role to fully trusted operators only - the trade-off is reduced self-service delegation for project teams. Increase monitoring of Rancher audit logs for unexpected cross-project or cluster-scoped actions performed by project-level accounts so that an attempted escalation is detectable. No vendor-described configuration-level workaround eliminates the flaw, so patching is the only complete fix.