CVE
CVE-2026-41052
Rancher has Privilege Escalation from Project Owner to Host in github.com/rancher/rancher
Rancher has Privilege Escalation from Project Owner to Host in github.com/rancher/rancher.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/rancher/rancher from v2.12.0 before v2.12.10, from v2.13.0 before v2.13.6, from v2.14.0 before v2.14.2.
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.4
-
4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
C
H
U
0
-
C
H
U
-
Related Resources
No items found.
References
https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744, https://nvd.nist.gov/vuln/detail/CVE-2026-41052, https://github.com/rancher/rancher/commit/2800aaac25b5a2c448f800e1f46d, https://github.com/rancher/rancher/pull/55061