8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41053

CVE-2026-41053: Over-inclusive team membership expansion in GitHub App authentication provider for Rancher

Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41053

CVE-2026-41053:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/rancher/rancher	go	>= 2.14.0, < 2.14.2	2.14.2
github.com/rancher/rancher	go	>= 2.13.0, < 2.13.6	2.13.6
github.com/rancher/rancher	go	< 0.0.0-20260519172014-d0c047bbc6d2	0.0.0-20260519172014-d0c047bbc6d2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the listTeamsForUser function within the GitHub App authentication provider of Rancher. The function was designed to list the teams a user belongs to, but it incorrectly iterated over all teams within a GitHub organization (org.teams) instead of the specific teams the user is a member of. The patch, identified in commit 361d4d57cd09b87f3c53f88af42046ffaa7b57e4, corrects this logic by changing the iteration to use the user-specific team list (g.members[username].orgs). This flaw allowed a user belonging to any single team in an organization to be incorrectly identified as a member of all teams in that organization, leading to a significant privilege escalation if those teams were linked to Rancher roles.

Vulnerable functions

gitHubAppData.listTeamsForUser

pkg/auth/providers/githubapp/github_data.go

The vulnerability lies in the `listTeamsForUser` function. The original code iterated over `org.teams`, which contains all teams in the organization, regardless of the user's membership. The patched code correctly iterates over `teamNames`, which is the list of teams the specific user belongs to within that organization. This incorrect iteration led to any authenticated user being granted permissions for every team within the entire organization.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.