What is the CVSS score of EUVD-2026-53298?

EUVD-2026-53298 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Rancher are affected by EUVD-2026-53298?

Rancher's authorization middleware contains a critical privilege escalation vulnerability allowing any authenticated user with default 'user' role permissions to forge administrative credentials and…. A patch is available.

How to fix or mitigate EUVD-2026-53298?

Within 24 hours, inventory all Rancher deployments, count connected managed clusters, restrict Rancher API access via firewall to administrative IPs only, and enable detailed audit logging of all API calls. Within 7 days, monitor Rancher's security advisories and the GHSA-v584-7w32-jwpq advisory for patch releases; test any available fixes in non-production environments and review interim mitigations if patching will be delayed. Within 30 days, deploy the vendor-released patch to all production Rancher instances once available, validate the fix by confirming that low-privileged users cannot forge impersonation headers, and verify cluster-admin access logs show no unauthorized elevation attempts.

Rancher EUVD-2026-53298

| CVE-2026-44945 CRITICAL

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441)

2026-08-05 meissner@suse.de

Privilege Escalation

9.1

CVSS 3.1 · Vendor: suse

Severity by source

Vendor (suse) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Any authenticated default-'user'-role account suffices (PR:L, not PR:H) via forged headers over the network with low complexity; control-plane compromise reaches downstream clusters, so S:C with full C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 05, 2026 - 11:02 EUVD

Source Code Evidence Fetched

Aug 05, 2026 - 10:32 vuln.today

Analysis Generated

Aug 05, 2026 - 10:32 vuln.today

CVE Published

Aug 05, 2026 - 10:17 cve.org

CRITICAL 9.1

DescriptionCVE.org

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages.

This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

AnalysisAI

Privilege escalation in Rancher's authorization (SAR) impersonation middleware lets an authenticated user holding only the default 'user' global role forge Impersonate-User and Impersonate-Group HTTP headers (e.g. impersonating cluster-admin or the system:masters group) to obtain full administrative control of the Rancher control plane and, transitively, every downstream cluster it manages. The flaw stems from the middleware trusting client-supplied impersonation headers instead of the authenticated identity in the request context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the upstream fix in rancher/rancher PR #55983 and advisory GHSA-v584-7w32-jwpq confirm the root cause and remediation.

Technical ContextAI

Rancher is a widely used multi-cluster Kubernetes management platform; its API server sits in front of many downstream clusters and enforces access via a SubjectAccessReview (SAR) middleware in pkg/auth/requests/sar/middleware.go and the impersonation logic in pkg/auth/requests/impersonate.go. The vulnerable code derived the acting user and groups from the HTTP Impersonate-User and Impersonate-Group headers (k8s authentication.ImpersonateUserHeader/ImpersonateGroupHeader) rather than from the authenticated principal, so any caller could assert an arbitrary identity. This is a classic CWE-441 (Unintended Proxy / Confused Deputy) issue: a trusted intermediary (Rancher's middleware) performs privileged authorization decisions on behalf of an identity the client controls. The fix reads userInfo from request.UserFrom(req.Context()) - the identity established by the authentication layer - and rejects requests lacking an authenticated context, so forged headers can no longer influence the SAR decision.

RemediationAI

Upgrade Rancher to a fixed release for your train: 2.11.16, 2.12.12, 2.13.8, or 2.14.2 or later, as documented in advisory GHSA-v584-7w32-jwpq (https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq) and implemented in PR #55983 (https://github.com/rancher/rancher/pull/55983). If immediate patching is not possible, reduce exposure by minimizing the number of standard 'user' global-role accounts, disabling self-service user registration, and restricting network access to the Rancher API/server so only trusted operators can reach it - with the trade-off that this limits legitimate tenant self-service; you can also front the Rancher endpoint with a proxy or WAF that strips client-supplied Impersonate-User and Impersonate-Group headers before they reach Rancher, noting this must not break Rancher's own internal impersonation flows and should be validated carefully. These are compensating controls only; the header-trust flaw is not fully closed without the vendor patch.