9.4 Critical

CVE-2026-44939 Command injection through unsanitized YAML parameter in Rancher

Description

A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.

CVSS 4.0 detail

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Exploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
Interaction: Passive
Confidentiality: High
Integrity: High
Availability: High
Confidentiality of other systems: High
Integrity of other systems: High
Availability of other systems: High

Affected products and versions

Product	Affected versions	Fixed in
Rancher 2.14	2.14.0 → < 2.14.2	2.14.2
Rancher 2.13	2.13.0 → < 2.13.6	2.13.6
Rancher 2.12	2.12.0 → < 2.12.10	2.12.10
Rancher 2.11	2.11.0 → < 2.11.14	2.11.14
Rancher 2.10	2.10.0 → < 2.10.12	2.10.12

References

github.com github.com

Timeline

Published June 19, 2026
Last modified November 3, 2026

The 86 CVEs of Rancher →

CVE-2026-88811 Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud… 9.1 Critical CVE-2026-88810 A privilege escalation issue was discovered in Rancher Manager's role-based access control 7.2 High CVE-2026-88809 A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy) 7.6 High CVE-2026-94290 SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent… 9.1 Critical

Track this CVE