public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 12:38:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add June CVEs

Browse Source
This commit is contained in:
Billy Tat
2026-06-29 17:08:27 -07:00
parent 877d8d64a4
commit 8e6e56c616
10 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
versioned_docs/version-2.11/reference-guides/rancher-security/security-advisories-and-cves.md
+2
View File
@@ -10,6 +10,8 @@ Rancher is committed to informing the community of security issues in our produc
| ID | Description | Date | Resolution |
|----|-------------|------|------------|
| [CVE-2026-44949](https://github.com/rancher/webhook/security/advisories/GHSA-h83p-cq95-vph4) | Fixed a security vulnerability in rancher-webhook where the FleetWorkspace mutating admission webhook performed side effects without authenticating requests, allowing a pod inside the cluster to create arbitrary namespaces and inject RBAC bindings. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
| [CVE-2026-44946](https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95) | Fixed a security vulnerability in Rancher's SAML authentication handler where a valid signed SAML response could be replayed by an attacker who had also captured the victim's pre-authentication SAML state cookie, allowing the attacker to create a separate authenticated session with the victim's permissions. All SAML providers (Okta, Ping, ADFS, Keycloak, Shibboleth) were affected. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
| [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10), [v2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14), and [v2.10.12](https://github.com/rancher/rancher/releases/tag/v2.10.12) |
| [CVE-2026-25705](https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35) | Rancher now protects against arbitrary file access via path traversal in Rancher Extensions. Note by default only users with administrative permissions can deploy UI extensions unless explicit permission is granted to other users. | 30 Apr 2026 | Rancher [v2.14.1](https://github.com/rancher/rancher/releases/tag/v2.14.1), [v2.13.5](https://github.com/rancher/rancher/releases/tag/v2.13.5), [v2.12.9](https://github.com/rancher/rancher/releases/tag/v2.12.9), and [v2.11.13](https://github.com/rancher/rancher/releases/tag/v2.11.13) |
| [CVE-2025-62879](https://github.com/rancher/backup-restore-operator/security/advisories/GHSA-wj3p-5h3x-c74q) | Rancher now provides new versions of the Rancher Backup chart which prevent the leak of secret S3 credentials via the Rancher Backup pod log. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |