# CVE-2026-44945

## Summary

- **CVE ID:** CVE-2026-44945
- **Severity:** CRITICAL
- **CVSS Score:** 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
- **CWE:** CWE-441, CWE-497
- **Published:** Aug 5, 2026
- **Last Modified:** Aug 6, 2026

## Description

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user
 global role can gain full administrative access to the Rancher control 
plane and transitively to all downstream clusters it manages.

This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

## Affected Products

- SUSE — Rancher (2.11.0)
- SUSE — Rancher (2.12.0)
- SUSE — Rancher (2.13.0)
- SUSE — Rancher (2.14.0)

## References

- [CNA](https://github.com/rancher/rancher/pull/55983)
- [CNA](https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq)
- [CNA](https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.38%
- **EPSS Percentile:** 31.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._