CVE-2026-41053
Fixed in a distro release EPSS <1%CVSS 8.8
Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.
Products: SUSE Rancher
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/rancher/rancher | 2.14.2 |
| Go | github.com/rancher/rancher | 2.13.6 |
| Go | github.com/rancher/rancher | 0.0.0-20260519172014-d0c047bbc6d2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | harvester | 1.8.1-r32 |
| Chainguard | harvester-fips | 1.8.1-r29 |
| Chainguard | harvester-fips-webhook | 1.8.1-r28 |
| Chainguard | harvester-webhook | 1.8.1-r32 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |