CRITICALCVSS 9.4EPSS 1.3%

CVE-2026-44939

CVE-2026-44939 updated by NVD

Published: 2026-07-01
Modified: 2026-11-05
EPSS percentile: 67%
Sources: github-advisory, nvd

Summary

A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Go	github.com/rancher/rancher	—	2.14.2, 2.13.6, 2.12.10, 2.11.14, 2.10.12, 0.0.0-20260617231817-2aa77eb283e7

Remediation: Upgrade to 2.14.2 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-44939

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.