Which versions of Kubernetes are affected by CVE-2026-44949?

SUSE Rancher's cluster admission webhook contains an authentication bypass flaw allowing unauthenticated network-adjacent attackers to forge identity data in Kubernetes workspace objects.. A patch is available.

How to fix or mitigate CVE-2026-44949?

Within 24 hours: Identify all Rancher deployments and document which affected versions (0.7.0-0.7.10, 0.8.0-0.8.7, 0.9.0-0.9.6, 0.10.0-0.10.7) are in production. Within 7 days: Contact SUSE for interim mitigation guidance; implement network policies restricting admission webhook access. Within 30 days: Monitor for vendor patch release and develop upgrade strategy to versions beyond 0.10.7; meanwhile, enforce RBAC controls and audit logging around workspace object operations.

Kubernetes CVE-2026-44949

Q: What is the CVSS score of CVE-2026-44949?

CVE-2026-44949 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40335 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-30 suse

Authentication Bypass Kubernetes Rancher Suse

7.0

CVSS 4.0 · Vendor: suse

Severity by source

Vendor (suse) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

MEDIUM

qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 30, 2026 - 16:01 EUVD

Analysis Generated

Jun 30, 2026 - 15:21 vuln.today

DescriptionCVE.org

A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0 up to 0.9.6 and 0.10.0 up to 0.10.7. An unauthenticated attacker with network access to the in-cluster rancher-webhook service could submit a crafted admission payload and cause workspace-related Kubernetes objects to be created with attacker-chosen identity data.

AnalysisAI

Authentication bypass in SUSE Rancher's in-cluster admission webhook (rancher-webhook) lets a network-adjacent, unauthenticated attacker forge FleetWorkspace admission payloads so that workspace-related Kubernetes objects are created with attacker-chosen identity data. Affected releases span Rancher 0.7.0–0.7.10, 0.8.0–0.8.7, 0.9.0–0.9.6 and 0.10.0–0.10.7, with integrity impact but no direct confidentiality or availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is documented in SUSE/Rancher advisory GHSA-h83p-cq95-vph4.