[UPDATE] [hoch] Rancher: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, und um Informationen offenzulegen.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2600
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-449450.74% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all scored CVEs.
- Low exploitation riskCVE-2026-559960.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all scored CVEs.
- Low exploitation riskCVE-2026-559970.08% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 0% of all scored CVEs.
- Low exploitation riskCVE-2026-559980.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all scored CVEs.
- Low exploitation riskCVE-2026-596750.43% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 36% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-44945 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-55996 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-55997 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-55998 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-59675 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- criticalCVE-2026-44945: A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/re…nvd
- highCVE-2026-59675: When API audit logging is enabled, the middleware reads the entire HTTP request body into memo…nvd
- mediumCVE-2026-55998: The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validatin…nvd
- highCVE-2026-55997: Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downs…nvd
- mediumCVE-2026-55996: A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both th…nvd
Recent advisories for Rancher
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalCVE-2026-44945: A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/re…nvd · 2026-08-05
- highCVE-2026-55997: Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downs…nvd · 2026-08-05
- mediumCVE-2026-55996: A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both th…nvd · 2026-08-05
- highCVE-2026-44937: Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fle…nvd · 2026-07-06
- mediumCVE-2026-44936: Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Ranc…nvd · 2026-07-06
- unknownCVE-2026-44934: A information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before 1.0.2 …nvd · 2026-07-06
More from CERT-Bund (BSI) Security Advisories
- medium[NEW] [medium] Linux Kernel: Multiple vulnerabilities2026-08-05
- medium[NEW] [medium] Linux Kernel: Multiple vulnerabilities2026-08-05
- medium[NEW] [medium] Linux Kernel: Multiple vulnerabilities allow unspecified attack2026-08-05
- high[NEW] [high] Ruby: Multiple vulnerabilities2026-08-05
- medium[NEW] [medium] Red Hat Enterprise Linux (freeipmi): Vulnerability allows denial of service2026-08-05