CVE-2026-41053: Rancher GitHub Authentication Privilege Escalation (CVSS 8.8)

Technical summary

CVE-2026-41053 is an authentication caching vulnerability in Rancher's GitHub authentication provider, specifically within the team membership expansion logic. The flaw allows the system to grant principal-level access to any authenticated user regardless of their actual GitHub team membership status. The root cause is improper handling of cached authentication state, where membership validation is bypassed or incorrectly applied during access control decisions. This affects SUSE Rancher versions 2.13.0 through 2.13.5 and 2.14.0 through 2.14.1. The vulnerability carries a CVSS v3.1 score of 8.8 (HIGH) with a network-based attack vector, low complexity, and requires only low privileges (an existing Rancher login), resulting in high impact to confidentiality, integrity, and availability.

Business impact

This vulnerability enables privilege escalation for any user with Rancher access, potentially allowing unauthorized viewing, modification, or deletion of sensitive configurations, workloads, and cluster resources. In multi-tenant environments, a low-privileged user or member of one team could access resources belonging to other teams or business units. The authentication bypass could facilitate lateral movement within Kubernetes clusters managed by Rancher and compromise the integrity of infrastructure-as-code and deployment pipelines. Organizations relying on GitHub team membership for RBAC enforcement are directly exposed to this risk.

Affected systems

SUSE Rancher versions 2.13.0 through 2.13.5 and 2.14.0 through 2.14.1 are affected. The vulnerability is specific to deployments using GitHub as the authentication provider with team-based access control. Rancher instances using other authentication methods (LDAP, local auth, SAML, etc.) are not affected. However, any Rancher environment integrating GitHub for user and team management should be treated as potentially vulnerable until patched.

Exploitability

This vulnerability is readily exploitable by any user with a valid Rancher login, requiring no special tools, code, or privileged access. An attacker would simply log in and attempt to access resources outside their assigned team or group. The low complexity and lack of interaction requirements mean exploitation can occur immediately upon gaining initial Rancher access. There is no known public exploit code, but the logical simplicity of testing cached authentication makes this a high-likelihood attack vector if not remediated.

Remediation

Upgrade SUSE Rancher immediately to version 2.13.6 or later for the 2.13 branch, or to version 2.14.2 or later for the 2.14 branch. After patching, conduct access reviews to verify that cached authentication has been cleared and re-evaluated. Monitor audit logs for evidence of unauthorized access attempts during the window the vulnerability existed. For organizations unable to patch immediately, consider restricting GitHub-based authentication or implementing network controls to limit Rancher access to trusted networks.

Patch guidance

Verify the exact version of SUSE Rancher running in your environment and cross-reference the vendor advisory for patched versions. Organizations on the 2.13 line should target 2.13.6 or the latest 2.13.x release; those on 2.14 should target 2.14.2 or later. Test patches in a non-production environment first to confirm compatibility with existing GitHub team configurations and RBAC policies. After patching, verify that GitHub team membership re-validation is functioning by testing access with test user accounts before resuming normal operations.

Detection guidance

Search audit and authentication logs for users accessing resources outside their assigned teams or roles immediately after GitHub authentication events. Look for unusual patterns in API token generation or use by low-privileged accounts. Monitor for access to sensitive namespaces, cluster configurations, or secrets by users not explicitly assigned to those resources. If using SIEM tooling, correlate Rancher access logs with GitHub team membership API calls to identify discrepancies. During the vulnerability window, prioritize review of any administrative or cross-team access granted to users in the 2-3 weeks prior to deploying the patch.

Why prioritize this

This vulnerability merits immediate patching due to the combination of high CVSS score (8.8), low attack complexity, low privilege requirements, and the broad blast radius of GitHub-authenticated Rancher deployments in enterprise environments. The flaw directly undermines the security model of teams and RBAC, which are fundamental to Rancher's multi-tenant architecture. Any organization using Rancher with GitHub authentication is a potential target, and the exploit path is straightforward for any authenticated user.

Risk score, explained

The CVSS score of 8.8 reflects a HIGH severity rating driven by: (1) network attack vector (AV:N)—vulnerability is remotely exploitable; (2) low attack complexity (AC:L)—no special conditions needed; (3) low privilege requirement (PR:L)—only needs any logged-in user; (4) high confidentiality impact (C:H)—user can view unauthorized data; (5) high integrity impact (I:H)—user can modify unauthorized resources; (6) high availability impact (A:H)—user could delete or disrupt services. The vulnerability does not propagate across system boundaries (S:U), but the combination of low-barrier access and complete compromise of three security properties elevates the overall risk substantially.

Frequently asked questions