CVE-2026-44945

This is a critical severity flaw in Rancher's authentication layer, not a configuration error. The vulnerability lives in pkg/auth/requests/impersonate.go — the middleware that handles user impersonation — and it allows any authenticated user with the default global role to impersonate higher-privilege service accounts, effectively escalating to full administrative control over the management plane. From there, every downstream cluster it manages becomes accessible. The specific failure is a missing or incomplete validation guard in the impersonation flow. When a non-admin user requests impersonation of a privileged identity, the middleware fails to reject the request properly. This isn't a case of a debug flag left on — it's a flaw in the core authentication logic that processes every user request. The blast radius is the real concern here. Compromising the Rancher management plane gives you transitively full access to every cluster it manages. This is the architectural cost of centralizing authentication in a multi-cluster management tool — one flaw in the auth layer cascades across your entire infrastructure. If you're running Rancher, you need to: verify you're on version 2.11.16 or later (or the equivalent patch in your active branch — 2.12.x, 2.13.x, and 2.14.x all received fixes), audit your user directory for any unexpected privilege escalation that may have occurred while unpatched, and review authentication logs for impersonation API calls originating from non-admin accounts — look for requests to /v1/impersonate or similar endpoints where the requesting principal differs from the target principal. This fits a known pattern across the Kubernetes ecosystem. CVE-2019-11246 was a nearly identical flaw in Kubernetes service account impersonation. The lesson is recurring: impersonation features create a legitimate privilege escalation capability that must be locked down per-caller explicitly, and the validation logic consistently fails when new principal types or roles are introduced without re-examining the trust model holistically.

Reviewed through automated stages and approved by a human before publication.