This vulnerability (CVE-2026-44939) in SUSE Rancher Manager cluster prior to version 2.14.2 involves a command injection via the import endpoint /v3/import/{token}_{clusterId}.yaml. Unsanitized YAML parameters can be exploited by remote attackers to break out of container images and execute arbitrary malicious containers. The issue is classified under CWE-95, indicating improper neutralization of directives in dynamically evaluated code, commonly known as eval injection. The CVSS 4.0 base score is 9.4, reflecting a critical severity with network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary commands by injecting malicious containers, potentially compromising the Rancher cluster's confidentiality, integrity, and availability. This could lead to full system compromise or disruption of container orchestration operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor SUSE's advisories for updates and avoid exposing the vulnerable import endpoint to untrusted networks until a patch is available.