CVE-2026-41052: Rancher Privilege Escalation from Project Owner to Host

Synopsis

A privilege escalation vulnerability exists in SUSE Rancher versions 2.12.x before 2.12.10, 2.13.x before 2.13.6, and 2.14.x before 2.14.2. The flaw is reachable over the network and requires a high-privilege (Project Owner) account, meaning an attacker must already hold that role within a Rancher project. Successful exploitation allows the attacker to escalate beyond their assigned Project Owner boundary to gain control at the host level, enabling full read, write, and availability impact across both the affected Rancher instance and dependent systems. Patched-image rebuilds at versions 2.12.10, 2.13.6, and 2.14.2 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Rancher API or UI over the network; the service must be exposed to the attacker's network path.

• AuthenticationRequired

  The attacker must hold an existing Project Owner account within Rancher; any account with that role is sufficient.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the privilege escalation entirely through their own requests.

• Attack complexityDetail

  The exploit is reliable and condition-free with no race conditions or special environmental factors required.

Blast Radius

• Attacker gains host-level access, reading sensitive data stored on the underlying host including secrets, credentials, and kubeconfig files.
• Attacker can write to or modify host-level resources, altering Rancher configuration, workloads, or cluster state across managed downstream clusters.
• Attacker can disrupt availability of the Rancher management plane and the downstream clusters it controls.
• Compromise extends to systems and clusters that depend on the affected Rancher instance, including any downstream Kubernetes environments under its management.