CVE-2026-41053

high

Description

Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.

References

https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40297

Details

Source: Mitre, NVD

Published: 2026-06-30

Updated: 2026-07-02

Named Vulnerability: GO-2026-5869Named Vulnerability: GHSA-4j6x-2764-m8gh

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H