Threat Intelligence Database

CVE-2026-44945 is a critical privilege escalation vulnerability in SUSE Rancher's impersonation middleware. An authenticated user with the default global user role can escalate privileges to gain full administrative access to the Rancher control plane and all downstream clusters it manages. The vulnerability affects Rancher versions from 2.11.0 before 2.11.16, 2.12.0 before 2.12.12, 2.13.0 before 2.13.8, and 2.14.0 before 2.14.2.

CVE-2026-59675 is a high-severity vulnerability in SUSE Rancher versions 2.12.0, 2.13.0, and 2.14.0. When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without size limits on login endpoints, bypassing the intended 1 MiB cap. This allows an unauthenticated attacker to send very large request bodies, causing excessive memory consumption and potential denial of service by crashing the Rancher Manager process, which disrupts API and UI availability and management of downstream clusters.

CVE-2026-55998 is a medium severity vulnerability in SUSE Rancher versions 2.11.0, 2.12.0, 2.13.0, and 2.14.0. The issue arises from an endpoint that retrieves cluster objects before validating tokens, causing different HTTP responses based on the existence of cluster IDs and their configuration. This discrepancy allows attackers to reliably enumerate valid cluster IDs.

CVE-2026-55996 is a denial-of-service vulnerability in SUSE Rancher affecting multiple TLS listeners. The issue arises because the dynamiclistener library appends any hostname presented via Server Name Indication (SNI) to the serving certificate's Subject Alternative Names (SANs) without effective filtering. An unauthenticated attacker with network access can exploit this by sending many TLS requests with distinct hostnames, causing the certificate to grow excessively large and resulting in TLS handshake failures and service disruption.