---
id: CVE-2026-44945
title: >-
  A privilege escalation vulnerability exists in Rancher's impersonation
  middleware (pkg/auth/requests/impersonate.go)
summary: >-
  A privilege escalation vulnerability exists in Rancher's impersonation
  middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user
  with the default user
   global role can gain full administrative access to the Rancher con…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-441
  - CWE-497
vendor: SUSE
product: Rancher
affected:
  - Rancher >= 2.11.0 < 2.11.16
  - Rancher >= 2.12.0 < 2.12.12
  - Rancher >= 2.13.0 < 2.13.8
  - Rancher >= 2.14.0 < 2.14.2
patched:
  - github.com/rancher/rancher 2.14.4
  - github.com/rancher/rancher 2.13.8
  - github.com/rancher/rancher 2.12.12
  - github.com/rancher/rancher 2.11.16
published: '2026-08-05'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T21:10:00.157'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44945'
references:
  - url: 'https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945'
    label: meissner@suse.de
  - url: 'https://github.com/rancher/rancher/pull/55983'
    label: meissner@suse.de
  - url: 'https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq'
    label: meissner@suse.de
tags:
  - nvd
  - cve.org
  - ghsa
  - go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-05T00:00:00+00:00'
aliases:
  - GHSA-v584-7w32-jwpq
ecosystem: go
epss: 0.0056
epssPercentile: 0.46437
ingestedAt: '2026-10-27T18:33:50.819Z'
---

## Overview

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user
 global role can gain full administrative access to the Rancher control 
plane and transitively to all downstream clusters it manages.

This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-44945)

Affected packages:

- `github.com/rancher/rancher >=2.14.0, <2.14.2`
- `github.com/rancher/rancher >=2.13.0, <2.13.8`
- `github.com/rancher/rancher >=2.12.0, <2.12.12`
- `github.com/rancher/rancher >=2.11.0, <2.11.16`

Patched in:

- `github.com/rancher/rancher 2.14.4`
- `github.com/rancher/rancher 2.13.8`
- `github.com/rancher/rancher 2.12.12`
- `github.com/rancher/rancher 2.11.16`

Source: https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq