PT-2026-50872 · Suse · Rancher

Michael Wollner + 1 · Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-44939

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Rancher Manager versions prior to 2.14.2

Description A command injection issue exists in the import endpoint "/v3/import/{token} {clusterId}.yaml". This occurs due to unsanitized YAML parameters, which could allow remote attackers to break out of an image and execute malicious containers.

Recommendations Update to version 2.14.2 or later.

Fix

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-44939

Affected Products

Rancher

References · 3

• https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44939 · Security Note
• https://twitter.com/vuldb/status/2067975337171186090 · Twitter Post