This vulnerability (CVE-2026-41052) in SUSE Rancher involves improper privilege handling that enables users assigned the Project Owner role to escalate their privileges beyond intended limits. It affects Rancher versions prior to 2.12.10, 2.13.6, and 2.14.2. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service.

Users with the Project Owner role can escalate their privileges, potentially gaining unauthorized access or control within the Rancher environment. This could compromise confidentiality, integrity, and availability of the affected systems. The vulnerability is rated critical with a CVSS score of 9.4, reflecting a severe security risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Project Owner role assignments to trusted users only and monitor for suspicious privilege escalations.