CVE-2026-44939
CriticalA command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g.
Published Jun 19, 2026 · Updated Oct 9, 2026 · Also known as EUVD-2026-38009, GHSA-mhc6-2gfq-xx62, GO-2026-5875
Key Facts
Patch in the next maintenance window- CVE-2026-44939 is a critical-severity vulnerability (CVSS 9.4 v4) affecting harvester (chainguard), harvester-fips (chainguard), github.com/rancher/rancher (go) and 1 more product.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 1.3% probability of exploitation in the next 30 days.
- Fixed versions are available, including github.com/rancher/rancher 0.0.0-20260617231817-2aa77eb283e7, github.com/rancher/rancher 2.10.12, github.com/rancher/rancher 2.11.14.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v4
9.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS (30-day exploit likelihood)
1.3%
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-44939 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.
Affected Products
5 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| harvesterchainguard | See advisory | 1.8.1-r32 |
| harvester-fipschainguard | See advisory | 1.8.1-r29 |
| github.com/rancher/ranchergo | >= 2.14.0 | 2.14.2 |
| Rancher | >= 2.14.0, >= 2.12.0 | 2.14.2 |
Patched Releases
github.com/rancher/rancher
0.0.0-20260617231817-2aa77eb283e7, 2.10.12, 2.11.14, 2.12.10, 2.13.6, 2.14.2
harvester
1.8.1-r32
harvester-fips
1.8.1-r29
Rancher
2.10.12, 2.11.14, 2.12.10, 2.13.6, 2.14.2
Timeline
Publicly disclosed
Jun 19, 2026
Last updated
Oct 9, 2026
Weakness Type
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44939.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-44939
- articlehttps://github.com/rancher/rancher/
- articlehttps://github.com/rancher/rancher/commit/2aa77eb283e7451d605fb85e1bd9b1791cd73875
FAQ
Common Questions.
A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g.
Affected: harvester (chainguard); harvester-fips (chainguard); github.com/rancher/rancher (go) versions >= 2.14.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including github.com/rancher/rancher 0.0.0-20260617231817-2aa77eb283e7, github.com/rancher/rancher 2.10.12, github.com/rancher/rancher 2.11.14.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-44939 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo