CVE-2026-44939
Fixed in a distro release EPSS 1%CVSS 9.4
A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.
Products: SUSE Rancher
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/rancher/rancher | 2.14.2 |
| Go | github.com/rancher/rancher | 2.13.6 |
| Go | github.com/rancher/rancher | 2.12.10 |
| Go | github.com/rancher/rancher | 2.11.14 |
| Go | github.com/rancher/rancher | 2.10.12 |
| Go | github.com/rancher/rancher | 0.0.0-20260617231817-2aa77eb283e7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | harvester | 1.8.1-r32 |
| Chainguard | harvester-fips | 1.8.1-r29 |
| Chainguard | harvester-fips-webhook | 1.8.1-r28 |
| Chainguard | harvester-webhook | 1.8.1-r32 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |