What is the CVSS score of CVE-2026-44939?

CVE-2026-44939 has a contested CVSS base score of 9.4 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-44939?

Yes, a patch is available for CVE-2026-44939. Update the affected software to the latest version immediately.

Rancher CVE-2026-44939

EUVD-2026-38009 CRITICAL

Eval Injection (CWE-95)

2026-06-19 suse

GHSA-mhc6-2gfq-xx62

Code Injection Command Injection Rancher

Critical

Disputed · 9.4 Vendor: suse

Severity by source

Sources disagree (Medium–Critical)

Vendor (suse) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Network-reachable import endpoint with no auth (AV:N/PR:N), low complexity, requires an operator to import the poisoned YAML (UI:R), and escapes the agent container into the managed cluster (S:C, C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: suse

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 27, 2026 - 10:33 vuln.today

Patch available

Jun 19, 2026 - 14:31 EUVD

Analysis Generated

Jun 19, 2026 - 13:03 vuln.today

CVE Published

Jun 19, 2026 - 12:13 cve.org

CRITICAL 9.4

DescriptionCVE.org

A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.

AnalysisAI

Command injection in Rancher Manager’s cluster import endpoint enables remote attackers to deploy malicious containers on downstream Kubernetes clusters using a crafted URL. The vulnerability affects Rancher versions 2.10.0–2.10.12, 2.11.0–2.11.14, 2.12.0–2.12.10, 2.13.0–2.13.6, and 2.14.0–2.14.2, and has a CVSS 4.0 score of 9.4. No active exploitation has been confirmed, and the EPSS exploitation probability is low at 1.11%, though a vendor-supplied patch is available.