CVE-2026-41052 CRITICAL

CVE-2026-41052: Rancher Privilege Escalation from Project Owner to Host

Vendor Suse

Product Rancher

Weakness CWE-305

Published June 29, 2026

Last update June 29, 2026

View on NVD All CVEs

CVSS base score

9.4/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.

Key dates

02Disclosure timeline

June 29, 2026 CVE published

June 29, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-41052 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/305.html

Identifiers

CVE CVE-2026-41052

CWE CWE-305

CVSS 9.4 / CRITICAL

Affected versions

Vendor Suse

Product Rancher

Affected ≥ 2.12.0 and < 2.12.10

Vendor Suse

Product Rancher

Affected ≥ 2.13.0 and < 2.13.6

Vendor Suse

Product Rancher

Affected ≥ 2.14.0 and < 2.14.2