Is there a patch available for CVE-2026-44947?

Yes, a patch is available for CVE-2026-44947. Update the affected software to the latest version immediately.

Rancher CVE-2026-44947

Q: What is the CVSS score of CVE-2026-44947?

CVE-2026-44947 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40327 MEDIUM

Improper Preservation of Permissions (CWE-281)

2026-06-30 suse

Authentication Bypass Rancher Suse

6.9

CVSS 4.0 · Vendor: suse

Severity by source

Vendor (suse) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Attacker is a project user (PR:L) exploiting stale bindings; AC:H reflects the specific precondition sequence required; no confidentiality or availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 30, 2026 - 16:01 EUVD

Analysis Generated

Jun 30, 2026 - 15:22 vuln.today

DescriptionCVE.org

A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security Admission (PSA) permissions after an administrator removes those permissions from a RoleTemplate.

AnalysisAI

Privilege persistence in SUSE Rancher allows project users to retain Pod Security Admission (PSA) permissions even after an administrator revokes those permissions from a RoleTemplate, due to a missing cleanup step in the legacy Project Role Template Binding (PRTB) reconciler. Affected versions are Rancher 2.13.0 through 2.13.7 and 2.14.0 through 2.14.3. An attacker with a pre-existing role assignment can continue to bypass PSA policies enforced at the project level, defeating administrative intent and potentially deploying workloads that violate the cluster's security posture. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

Rancher (CPE: cpe:2.3:a:suse:rancher) is SUSE's Kubernetes multi-cluster management platform. Project Role Template Bindings (PRTBs) are Rancher-internal custom resources that map users or groups to named RoleTemplates within a project scope. The legacy PRTB reconciler is responsible for propagating and cleaning up RBAC objects - including Pod Security Admission (PSA) level labels and bindings - when a RoleTemplate's permissions change. CWE-281 (Improper Preservation of Permissions) describes the root cause: when an administrator removes PSA-related permissions from a RoleTemplate, the reconciler fails to delete the already-materialized PSA bindings for users previously bound through PRTBs. The term 'legacy' reconciler implies a separate, newer code path exists that may handle this correctly, making the flaw specific to the older reconciliation flow rather than the entire PRTB subsystem.

RemediationAI

Consult the vendor advisory at https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc for confirmed fix versions; based on the reported affected ranges (up to 2.13.7 and up to 2.14.3), fixed releases are expected to be 2.13.8 and 2.14.4 or later, but these versions have not been independently confirmed from the data provided. As a compensating control prior to patching, administrators should audit existing PRTBs and manually verify that PSA-related RoleBindings in affected projects have been removed for users whose RoleTemplate access was revoked - this can be done via kubectl by inspecting RoleBindings within affected namespaces for stale PSA-related entries. Restricting the legacy PRTB reconciler path through Rancher feature flags, if available, should also be evaluated. Note that manual audit is labor-intensive in large multi-project environments and is not a substitute for the upstream fix.