CVE-2026-44939: Rancher Manager Command Injection via Cluster Import YAML Endpoint
CVE-2026-44939 affects Rancher Manager versions before 2.14.2, where the cluster import endpoint does not sanitize YAML parameters, enabling command injection. According to the CNA's CVSS v4.0 score of 9.4, a remote attacker could potentially escape an image context and run malicious containers. The record shows no confirmed exploitation in the sources consulted, and the affected and fixed product fields are empty.
Overview
CVE-2026-44939 is a command injection issue in the cluster import endpoint of Rancher Manager. The description states that YAML parameters are not sanitized before processing, which could let a remote attacker break out of an image context and run malicious containers. The record lists a GitHub Security Advisory, GHSA-mhc6-2gfq-xx62, as a reference.
Impact
- The CVSS v4.0 base score of 9.4, assigned by the CNA, indicates high impact on confidentiality, integrity and availability.
- The vector indicates network attack, low complexity, no privileges required and user interaction required.
- The description says an attacker could run malicious containers, which may affect the clusters managed through Rancher.
Affected products and versions
- The description states that Rancher Manager versions before 2.14.2 are affected.
- The structured affected-products field in the record is empty, so the precise affected range should be confirmed against the vendor advisory.
- The record does not list fixed versions. The 2.14.2 boundary in the description suggests it is the first unaffected release, but this is an inference.
Exploitation status
- The record indicates the CVE is not listed in CISA KEV.
- No confirmed exploitation appears in the sources consulted.
- No EPSS score is available in the record.
Remediation and mitigation
- Identify Rancher Manager deployments and their versions.
- Plan an upgrade to Rancher Manager 2.14.2 or later, following the vendor guidance in the advisory.
- Until patching is complete, restrict access to the cluster import functionality to trusted networks and administrators, as a defensive measure.
- Review the vendor advisory for any additional workarounds.
Detection guidance
- Review Rancher Manager logs for unusual requests to cluster import endpoints, particularly from unexpected sources.
- Monitor managed clusters for unexpected container deployments or images that were not created through normal workflows.
- Correlate Rancher audit events with cluster-level events to spot anomalous imports.
Limitations of the available information
- The record's title is empty; the title in this analysis was written from the description.
- The description refers to command injection, while the CWE listed is CWE-95 Eval Injection. The exact root cause is not confirmed by the record.
- The structured affected and fixed version fields are empty.
- The full vendor advisory text was not included in the record, so details beyond the description are unknown.
- NVD entry and CVE Record were used as official sources.
Frequently asked questions
What is CVE-2026-44939?
It is a command injection vulnerability in the cluster import endpoint of Rancher Manager versions before 2.14.2, caused by unsanitized YAML parameters.
Is CVE-2026-44939 being exploited in the wild?
The record indicates it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Which version should I upgrade to?
The description indicates versions before 2.14.2 are affected. Upgrading to 2.14.2 or later is likely appropriate, but the vendor advisory should be checked to confirm the fixed version.
What should administrators do now?
Identify Rancher Manager deployments, plan an upgrade, restrict access to cluster import functionality, and monitor for unexpected container deployments.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.