9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41052

CVE-2026-41052: Rancher Privilege Escalation from Project Owner to Host

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41052

CVE-2026-41052:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/rancher/rancher	go	>= 2.14.0, < 2.14.2	2.14.2
github.com/rancher/rancher	go	>= 2.13.0, < 2.13.6	2.13.6
github.com/rancher/rancher	go	>= 2.12.0, < 2.12.10	2.12.10
github.com/rancher/rancher	go	< 0.0.0-20260513182521-2800aaac25b5	0.0.0-20260513182521-2800aaac25b5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from Rancher assigning overly broad permissions to the 'project-owner' role. Specifically, the createProjectMembershipRoles function in pkg/controllers/management/auth/project_cluster/common.go was using a wildcard (*) for allowed actions (verbs) on project resources. This unintentionally granted the permission to modify Pod Security Admission (PSA) settings (updatepsa).

An attacker with 'project-owner' permissions could exploit this by creating a namespace and then changing its PSA policy to 'privileged'. This would allow them to deploy privileged containers, bypassing normal security sandboxing and gaining control over the underlying host node.

The patch corrects this by replacing the wildcard with a specific list of approved verbs, explicitly excluding updatepsa. The function createClusterMembershipRoles was also patched for a similar vulnerability related to the 'cluster-owner' role.

Vulnerable functions

project_cluster.createProjectMembershipRoles

pkg/controllers/management/auth/project_cluster/common.go

This function creates the 'project-owner' role. Before the patch, it assigned wildcard ('*') permissions on project resources. This allowed a project owner to use the 'updatepsa' verb to modify Pod Security Admission labels on namespaces to 'privileged', leading to container breakout and host-level privilege escalation.

project_cluster.createClusterMembershipRoles

pkg/controllers/management/auth/project_cluster/common.go

This function creates the 'cluster-owner' role. Similar to 'createProjectMembershipRoles', it assigned wildcard ('*') permissions on cluster resources before the patch. This overly permissive configuration was also fixed to prevent potential privilege escalation by restricting the allowed verbs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.