NCSC-2026-0220 [1.00] [M/H] Vulnerabilities fixed in Rancher by Rancher Labs

unknownCVE-2026-44946 CVE-2026-44947

Rancher Labs has fixed vulnerabilities in Rancher versions 2.13.0 to 2.13.7 and 2.14.0 to 2.14.3. The first vulnerability concerns a SAML authentication replay issue in the Assertion Consumer Service (ACS) handler in Rancher versions 2.14.0 to, but not including, 2.14.3. The ACS handler does not enforce the one-time use of SAML assertions, allowing an attacker to reuse intercepted assertions. This can lead to man-in-the-middle attacks that compromise the integrity of the authentication process. The second vulnerability is in the legacy Project Role Template Binding reconciler in Rancher versions 2.13.0 to 2.13.7 and 2.14.0 to 2.14.3. Due to the lack of a cleanup step, users can retain Pod Security Admission permissions that should have been revoked when an administrator removes these permissions from a RoleTemplate. This is because the reconciler does not correctly update or remove permissions, allowing unauthorized access to persist and users to potentially retain elevated privileges outside their allowed scope.

CSIRTS triage

vendor: Rancher Labs product: Rancher Authentication bypass Privilege escalationaffected: 2.13.0 to 2.13.7 and 2.14.0 to 2.14.3

What: Vulnerabilities in Rancher allow for SAML authentication replay and improper permission management.
Who is affected: Deployments of Rancher versions 2.13.0 to 2.13.7 and 2.14.0 to 2.14.3 are affected.
Urgency: Remediation is medium to high urgency due to the potential for exploitation and the impact on authentication integrity.
Action: Apply patches immediately.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Rancher

Get an email when a new Rancher advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-07-03
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0220

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-449460.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all scored CVEs.
Low exploitation riskCVE-2026-449470.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-44946	coverage & exploitation status	NVD · CVE.org
CVE-2026-44947	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Rancher by Rancher

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-44937: Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fle…nvd · 2026-07-06
mediumCVE-2026-44936: Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Ranc…nvd · 2026-07-06
unknownCVE-2026-44934: A information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before 1.0.2 …nvd · 2026-07-06
criticalCVE-2026-44935: Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 befo…nvd · 2026-07-02
unknownCVE-2026-44948: A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.…nvd · 2026-06-30
unknownCVE-2026-44949: A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook h…nvd · 2026-06-30