This vulnerability (CVE-2026-44945) involves a confused deputy issue (CWE-441) in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). It allows an authenticated Rancher user with the default user global role to escalate privileges to full administrative rights on the Rancher control plane and transitively on all downstream clusters managed by Rancher. The vulnerability affects multiple Rancher versions starting from 2.11.0 up to but not including 2.11.16, 2.12.0 up to but not including 2.12.12, 2.13.0 up to but not including 2.13.8, and 2.14.0 up to but not including 2.14.2. The CVSS v3.1 base score is 9.1, indicating critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and complete confidentiality, integrity, and availability impact.

An attacker with authenticated access and the default user global role can escalate privileges to gain full administrative control over the Rancher control plane and all downstream clusters it manages. This could lead to complete compromise of the Rancher environment and any Kubernetes clusters managed by it, including unauthorized access, modification, and disruption of cluster operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Users should monitor SUSE's official advisories for updates and apply patches once available. Until then, restrict access to Rancher users with the default user global role and consider additional access controls or monitoring to detect suspicious privilege escalation attempts.