This vulnerability (CVE-2026-44945) involves a confused deputy issue (CWE-441) in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). It allows an authenticated user with the default global user role to escalate privileges to full administrative access over the Rancher control plane and all managed downstream clusters. The flaw affects multiple Rancher versions starting from 2.11.0 up to but not including 2.11.16, 2.12.0 up to but not including 2.12.12, 2.13.0 up to but not including 2.13.8, and 2.14.0 up to but not including 2.14.2. The CVSS 3.1 score is 9.1, indicating a critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and complete confidentiality, integrity, and availability impact.

An attacker with authenticated access and the default global user role can gain full administrative privileges on the Rancher control plane, allowing control over all downstream clusters managed by Rancher. This can lead to complete compromise of the container orchestration environment, including potential disruption, data loss, or unauthorized access to sensitive workloads.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles carefully and monitor for suspicious privilege escalations. Avoid granting default global user roles broadly. Follow SUSE Rancher's official advisories for updates and patches.