CVE-2026-41052
Fixed in a distro release EPSS <1%CVSS 9.4
Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.
Products: SUSE Rancher
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/rancher/rancher | 2.14.2 |
| Go | github.com/rancher/rancher | 2.13.6 |
| Go | github.com/rancher/rancher | 2.12.10 |
| Go | github.com/rancher/rancher | 0.0.0-20260513182521-2800aaac25b5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | harvester | 1.8.1-r32 |
| Chainguard | harvester-fips | 1.8.1-r29 |
| Chainguard | harvester-fips-webhook | 1.8.1-r28 |
| Chainguard | harvester-webhook | 1.8.1-r32 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |