Merge pull request #2365 from btat/june-cves

Add June CVEs
2026-09-29 14:38:50 +00:00 · 2026-06-29 17:36:01 -07:00 · 2026-06-29 17:08:27 -07:00 · 2026-06-29 15:26:42 -07:00 · 2026-06-29 15:26:15 -07:00 · 2026-06-29 14:59:19 -07:00
54 changed files with 283 additions and 56 deletions
@@ -12,6 +12,7 @@ Rancher will publish deprecated features as part of the [release notes](https://

 | Patch Version |  Release Date |
 |---------------|---------------|
+| [2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3) | June 29, 2026  |
 | [2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2) | May 28, 2026   |
 | [2.14.1](https://github.com/rancher/rancher/releases/tag/v2.14.1) | April 30, 2026 |
 | [2.14.0](https://github.com/rancher/rancher/releases/tag/v2.14.0) | March 25, 2026 |
@@ -1,11 +1,18 @@
 ---
-title: Rancher Prime AWS Marketplace Quick Start
-description: Deploy SUSE Rancher from the AWS Marketplace listing.
+title: Rancher for AWS
+description: Learn about Rancher for AWS from the AWS Marketplace listing.
 ---

 <head>
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace"/>
 </head>

-You can quickly deploy Rancher Prime on Amazon Elastic Kubernetes Service (EKS.) To learn more, see the [instructions](https://suse-enceladus.github.io/marketplace-docs/rancher-prime/aws/?repository=rancher-payg-billing-adapter-llc-prd) under Usage Information in the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-f2bvszurj2p2c). 
+SUSE Rancher for AWS (SRA/SRFA) is a fully managed Software-as-a-Service (SaaS) offering available through the [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-yrzugbpzuukww). It provides a centralized control plane to manage, monitor, and scale Kubernetes clusters within an AWS environment.

+For deployment prerequisites, architecture requirements, and subscription details, refer to the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-yrzugbpzuukww). For more information, refer to the [product documentation](https://documentation.suse.com/cloudnative/rancher-srfa/).
+
+:::note
+
+SUSE Rancher for AWS is an offering distinct from deploying and managing the Rancher server manually on Amazon EKS. If you intend to install and manage your own Rancher deployment on an EKS cluster, refer to [Installing Rancher on Amazon EKS](../../installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md).
+
+:::
@@ -19,6 +19,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers

 | Rancher Version | Adapter Version  |
 |-----------------|------------------|
+| v2.14.3         |  109.0.0+up9.0.0 |
 | v2.14.2         |  109.0.0+up9.0.0 |
 | v2.14.1         |  109.0.0+up9.0.0 |
 | v2.14.0         |  109.0.0+up9.0.0 |
@@ -104,7 +104,8 @@ Each self-assessment guide is accompanied by a hardening guide. These guides wer
 | Standalone RKE2 | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.rke2.io/security/cis_self_assessment18) | [Link](https://docs.rke2.io/security/hardening_guide) |
 | Standalone RKE2 | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.rke2.io/security/cis_self_assessment19) | [Link](https://docs.rke2.io/security/hardening_guide) |
 | Standalone RKE2 | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.rke2.io/security/cis_self_assessment110) | [Link](https://docs.rke2.io/security/hardening_guide) |
-| Standalone RKE2 | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.rke2.io/security/cis_self_assessment111) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.29 to v1.31 | CIS v1.11 | [Link](https://docs.rke2.io/security/cis_self_assessment111) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.32 and above | CIS v1.12 | [Link](https://docs.rke2.io/security/cis_self_assessment112) | [Link](https://docs.rke2.io/security/hardening_guide) |

 ### K3s Guides

@@ -113,4 +114,6 @@ Each self-assessment guide is accompanied by a hardening guide. These guides wer
 | Standalone K3s | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.k3s.io/security/self-assessment-1.8) | [Link](https://docs.k3s.io/security/hardening-guide) |
 | Standalone K3s | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.k3s.io/security/self-assessment-1.9) | [Link](https://docs.k3s.io/security/hardening-guide) |
 | Standalone K3s | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.k3s.io/security/self-assessment-1.10) | [Link](https://docs.k3s.io/security/hardening-guide) |
-| Standalone K3s | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.k3s.io/security/self-assessment-1.11) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.29 to v1.31 | CIS v1.11 | [Link](https://docs.k3s.io/security/self-assessment-1.11) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.32 and above | CIS v1.12 | [Link](https://docs.k3s.io/security/self-assessment-1.12) | [Link](https://docs.k3s.io/security/hardening-guide) |
+
@@ -10,6 +10,12 @@ Rancher is committed to informing the community of security issues in our produc

 | ID | Description | Date | Resolution |
 |----|-------------|------|------------|
+| [CVE-2026-44949](https://github.com/rancher/webhook/security/advisories/GHSA-h83p-cq95-vph4) | Fixed a security vulnerability in rancher-webhook where the FleetWorkspace mutating admission webhook performed side effects without authenticating requests, allowing a pod inside the cluster to create arbitrary namespaces and inject RBAC bindings. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-44947](https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc) | Fixed a security vulnerability in Rancher's legacy PRTB reconciler where removing the `updatepsa` permission from a RoleTemplate did not clean up stale PSA ClusterRole and ClusterRoleBinding resources, allowing affected users to retain unauthorized Pod Security Admission access indefinitely. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3) and Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7) |
+| [CVE-2026-44946](https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95) | Fixed a security vulnerability in Rancher's SAML authentication handler where a valid signed SAML response could be replayed by an attacker who had also captured the victim's pre-authentication SAML state cookie, allowing the attacker to create a separate authenticated session with the victim's permissions. All SAML providers (Okta, Ping, ADFS, Keycloak, Shibboleth) were affected. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-41053](https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh) | Fixed a security vulnerability in the GitHub App authentication provider where users incorrectly inherited permissions from all teams within their GitHub organization, rather than only the specific teams to which they belonged. Upon upgrading, Rancher automatically triggers a mandatory refresh of all affected user `principals` to remove these incorrectly assigned team memberships and restore proper access. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6) |
+| [CVE-2026-41052](https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744) | Updated the permissions of the built-in `project-owner` role to no longer include the `updatepsa` verb. This prevents users with this role from bypassing restricted PSA policies or deploying privileged workloads within their projects. If your organization requires users to retain this capability, administrators must create a custom project role that explicitly grants the `updatepsa` verb for the project resource. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10) |
+| [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10), [v2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14), and [v2.10.12](https://github.com/rancher/rancher/releases/tag/v2.10.12) |
 | [CVE-2026-25705](https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35) | Rancher now protects against arbitrary file access via path traversal in Rancher Extensions. Note by default only users with administrative permissions can deploy UI extensions unless explicit permission is granted to other users. | 30 Apr 2026 | Rancher [v2.14.1](https://github.com/rancher/rancher/releases/tag/v2.14.1), [v2.13.5](https://github.com/rancher/rancher/releases/tag/v2.13.5), [v2.12.9](https://github.com/rancher/rancher/releases/tag/v2.12.9), and [v2.11.13](https://github.com/rancher/rancher/releases/tag/v2.11.13) |
 | [CVE-2025-62879](https://github.com/rancher/backup-restore-operator/security/advisories/GHSA-wj3p-5h3x-c74q) | Rancher now provides new versions of the Rancher Backup chart which prevent the leak of secret S3 credentials via the Rancher Backup pod log. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2025-67601](https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p) | Rancher now removes the ability to fetch CA certificates stored in Rancher’s setting `cacerts` when using the `login` command. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
@@ -8,6 +8,12 @@ title: About rancher-selinux

 To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM.

+:::tip Why SELinux?
+
+By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised.
+
+:::
+
 The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled.

 The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux)
@@ -16,7 +22,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra

 :::note Requirement:

-The `rancher-selinux` RPM was tested on openSUSE Tumbleweed and RHEL-based distributions including Centos/RockyLinux 8 and 9. 
+The `rancher-selinux` RPM was tested on openSUSE MicroOS, Fedora 42, and RHEL-based distributions including CentOS/RockyLinux 8, 9, and 10.

 :::

@@ -50,6 +56,19 @@ gpgkey=https://rpm.rancher.io/public.key
 EOF
 ```

+In order to use the RPM repository, on a CentOS 10 or RHEL 10 system, run the following bash snippet:
+
+```
+# cat << EOF > /etc/yum.repos.d/rancher.repo 
+[rancher] 
+name=Rancher 
+baseurl=https://rpm.rancher.io/rancher/production/centos/10/noarch
+enabled=1 
+gpgcheck=1 
+gpgkey=https://rpm.rancher.io/public.key 
+EOF
+```
+
 ### 2. Installing the RPM

 Install the RPM:
@@ -58,14 +77,16 @@ Install the RPM:
 yum -y install rancher-selinux
 ```

-## Configuring the Logging and Monitoring Applications to Work with SELinux
+## Configuring Applications to Work with SELinux

 :::note Requirement:

-Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, and Tumbleweed.
+Logging v2, Monitoring v2, and Rancher AI were tested with SELinux on RHEL/CentOS 8, 9, 10, and Tumbleweed.

 :::

-Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM. 
+The `rancher-selinux` RPM currently covers the following charts: **Logging**, **Monitoring**, and **Rancher AI**.

-To configure the `rancher-logging` or the `rancher-monitoring` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts.
+Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM.
+
+To configure these charts to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts.
@@ -20,7 +20,8 @@ Each Rancher version is designed to be compatible with a single version of the w

 | Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
 |-----------------|-----------------|-----------------------|---------------------------|
-| v2.14.2         |    v0.10.5      | &check;               | &check;                   |
+| v2.14.3         |    v0.10.7      | &check;               | &check;                   |
+| v2.14.2         |    v0.10.6      | &check;               | &check;                   |
 | v2.14.1         |    v0.10.4      | &check;               | &check;                   |
 | v2.14.0         |    v0.10.0      | &cross;               | &check;                   |

@@ -10,6 +10,12 @@ Rancher 致力于向社区披露我们产品的安全问题。我们会针对已

 | ID | 描述 | 日期 | 解决 |
 |----|-------------|------|------------|
+| [CVE-2026-44949](https://github.com/rancher/webhook/security/advisories/GHSA-h83p-cq95-vph4) | Fixed a security vulnerability in rancher-webhook where the FleetWorkspace mutating admission webhook performed side effects without authenticating requests, allowing a pod inside the cluster to create arbitrary namespaces and inject RBAC bindings. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-44947](https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc) | Fixed a security vulnerability in Rancher's legacy PRTB reconciler where removing the `updatepsa` permission from a RoleTemplate did not clean up stale PSA ClusterRole and ClusterRoleBinding resources, allowing affected users to retain unauthorized Pod Security Admission access indefinitely. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3) and Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7) |
+| [CVE-2026-44946](https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95) | Fixed a security vulnerability in Rancher's SAML authentication handler where a valid signed SAML response could be replayed by an attacker who had also captured the victim's pre-authentication SAML state cookie, allowing the attacker to create a separate authenticated session with the victim's permissions. All SAML providers (Okta, Ping, ADFS, Keycloak, Shibboleth) were affected. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-41053](https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh) | Fixed a security vulnerability in the GitHub App authentication provider where users incorrectly inherited permissions from all teams within their GitHub organization, rather than only the specific teams to which they belonged. Upon upgrading, Rancher automatically triggers a mandatory refresh of all affected user `principals` to remove these incorrectly assigned team memberships and restore proper access. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6) |
+| [CVE-2026-41052](https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744) | Updated the permissions of the built-in `project-owner` role to no longer include the `updatepsa` verb. This prevents users with this role from bypassing restricted PSA policies or deploying privileged workloads within their projects. If your organization requires users to retain this capability, administrators must create a custom project role that explicitly grants the `updatepsa` verb for the project resource. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10) |
+| [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10), [v2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14), and [v2.10.12](https://github.com/rancher/rancher/releases/tag/v2.10.12) |
 | [CVE-2025-62879](https://github.com/rancher/backup-restore-operator/security/advisories/GHSA-wj3p-5h3x-c74q) | Rancher now provides new versions of the Rancher Backup chart which prevent the leak of secret S3 credentials via the Rancher Backup pod log. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2025-67601](https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p) | Rancher now removes the ability to fetch CA certificates stored in Rancher’s setting `cacerts` when using the `login` command. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2023-32199](https://github.com/rancher/rancher/security/advisories/GHSA-j4vr-pcmw-hx59) | Rancher now removes the corresponding ClusterRoleBindings whenever the admin GlobalRole or its GlobalRoleBindings are deleted. Previously orphaned ClusterRoleBindings were marked with the annotation `authz.cluster.cattle.io/admin-globalrole-missing=true`. | 23 Oct 2025 | Rancher [v2.12.3](https://github.com/rancher/rancher/releases/tag/v2.12.3) and [v2.11.7](https://github.com/rancher/rancher/releases/tag/v2.11.7) |
@@ -10,6 +10,7 @@ Rancher 致力于向社区披露我们产品的安全问题。我们会针对已

 | ID | 描述 | 日期 | 解决 |
 |----|-------------|------|------------|
+| [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10), [v2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14), and [v2.10.12](https://github.com/rancher/rancher/releases/tag/v2.10.12) |
 | [CVE-2025-62879](https://github.com/rancher/backup-restore-operator/security/advisories/GHSA-wj3p-5h3x-c74q) | Rancher now provides new versions of the Rancher Backup chart which prevent the leak of secret S3 credentials via the Rancher Backup pod log. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2025-67601](https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p) | Rancher now removes the ability to fetch CA certificates stored in Rancher’s setting `cacerts` when using the `login` command. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2024-58260](https://github.com/rancher/rancher/security/advisories/GHSA-q82v-h4rq-5c86) | Setting the username of one user as the same username of another user causes an error when either user attempts to log in. Therefore, a user with the `Manage Users` permission could potentially deny any user, including admins, from logging in. To prevent this, usernames have been made immutable once set, and it is not possible to update or create a user with a username that is already in use. | 25 Sep 2025 | Rancher [v2.12.2](https://github.com/rancher/rancher/releases/tag/v2.12.2), [v2.11.6](https://github.com/rancher/rancher/releases/tag/v2.11.6), [v2.10.10](https://github.com/rancher/rancher/releases/tag/v2.10.10), and [v2.9.12](https://github.com/rancher/rancher/releases/tag/v2.9.12) |
@@ -12,6 +12,7 @@ Rancher 将在 GitHub 上发布的 Rancher 的[发版说明](https://github.com/

 | Patch 版本                                                      | 发布时间           |
 | --------------------------------------------------------------- | ------------------ |
+| [2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) | 2026 年 06 月 29 日 |
 | [2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14) | 2026 年 05 月 27 日 |
 | [2.11.13](https://github.com/rancher/rancher/releases/tag/v2.11.13) | 2026 年 04 月 30 日 |
 | [2.11.12](https://github.com/rancher/rancher/releases/tag/v2.11.12) | 2026 年 03 月 25 日 |
@@ -15,6 +15,7 @@ title: 安装 Adapter

 | Rancher 版本 | Adapter 版本 |
 |-----------------|:----------------:|
+| v2.11.15        | v106.0.1+up6.0.1 |
 | v2.11.14        | v106.0.1+up6.0.1 |
 | v2.11.13        | v106.0.0+up6.0.0 |
 | v2.11.12        | v106.0.0+up6.0.0 |
@@ -10,6 +10,9 @@ Rancher 致力于向社区披露我们产品的安全问题。我们会针对已

 | ID | 描述 | 日期 | 解决 |
 |----|-------------|------|------------|
+| [CVE-2026-44949](https://github.com/rancher/webhook/security/advisories/GHSA-h83p-cq95-vph4) | Fixed a security vulnerability in rancher-webhook where the FleetWorkspace mutating admission webhook performed side effects without authenticating requests, allowing a pod inside the cluster to create arbitrary namespaces and inject RBAC bindings. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-44946](https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95) | Fixed a security vulnerability in Rancher's SAML authentication handler where a valid signed SAML response could be replayed by an attacker who had also captured the victim's pre-authentication SAML state cookie, allowing the attacker to create a separate authenticated session with the victim's permissions. All SAML providers (Okta, Ping, ADFS, Keycloak, Shibboleth) were affected. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10), [v2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14), and [v2.10.12](https://github.com/rancher/rancher/releases/tag/v2.10.12) |
 | [CVE-2025-62879](https://github.com/rancher/backup-restore-operator/security/advisories/GHSA-wj3p-5h3x-c74q) | Rancher now provides new versions of the Rancher Backup chart which prevent the leak of secret S3 credentials via the Rancher Backup pod log. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2025-67601](https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p) | Rancher now removes the ability to fetch CA certificates stored in Rancher’s setting `cacerts` when using the `login` command. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2023-32199](https://github.com/rancher/rancher/security/advisories/GHSA-j4vr-pcmw-hx59) | Rancher now removes the corresponding ClusterRoleBindings whenever the admin GlobalRole or its GlobalRoleBindings are deleted. Previously orphaned ClusterRoleBindings were marked with the annotation `authz.cluster.cattle.io/admin-globalrole-missing=true`. | 23 Oct 2025 | Rancher [v2.12.3](https://github.com/rancher/rancher/releases/tag/v2.12.3) and [v2.11.7](https://github.com/rancher/rancher/releases/tag/v2.11.7) |
@@ -20,6 +20,7 @@ Rancher 将 Rancher-Webhook 作为单独的 deployment 和服务部署在 local

 | Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
 |-----------------|-----------------|-----------------------|---------------------------|
+| v2.11.15        |     v0.7.10     | &check;               | &cross;                   |
 | v2.11.14        |     v0.7.9      | &check;               | &cross;                   |
 | v2.11.13        |     v0.7.8      | &check;               | &cross;                   |
 | v2.11.12        |     v0.7.8      | &check;               | &cross;                   |
@@ -12,6 +12,7 @@ Rancher 将在 GitHub 上发布的 Rancher 的[发版说明](https://github.com/

 | Patch 版本                                                         | 发布时间            |
 | ----------------------------------------------------------------- | ------------------ |
+| [2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) | 2026 年 06 月 29 日 |
 | [2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10) | 2026 年 05 月 27 日 |
 | [2.12.9](https://github.com/rancher/rancher/releases/tag/v2.12.9) | 2026 年 04 月 30 日 |
 | [2.12.8](https://github.com/rancher/rancher/releases/tag/v2.12.8) | 2026 年 03 月 25 日 |
@@ -15,6 +15,7 @@ title: 安装 Adapter

 | Rancher 版本 | Adapter 版本 |
 |-----------------|:----------------:|
+| v2.12.11         |  107.0.0+up7.0.0 |
 | v2.12.10         |  107.0.0+up7.0.0 |
 | v2.12.9         |  107.0.0+up7.0.0 |
 | v2.12.8         |  107.0.0+up7.0.0 |
@@ -10,6 +10,10 @@ Rancher 致力于向社区披露我们产品的安全问题。我们会针对已

 | ID | 描述 | 日期 | 解决 |
 |----|-------------|------|------------|
+| [CVE-2026-44949](https://github.com/rancher/webhook/security/advisories/GHSA-h83p-cq95-vph4) | Fixed a security vulnerability in rancher-webhook where the FleetWorkspace mutating admission webhook performed side effects without authenticating requests, allowing a pod inside the cluster to create arbitrary namespaces and inject RBAC bindings. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-44946](https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95) | Fixed a security vulnerability in Rancher's SAML authentication handler where a valid signed SAML response could be replayed by an attacker who had also captured the victim's pre-authentication SAML state cookie, allowing the attacker to create a separate authenticated session with the victim's permissions. All SAML providers (Okta, Ping, ADFS, Keycloak, Shibboleth) were affected. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-41052](https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744) | Updated the permissions of the built-in `project-owner` role to no longer include the `updatepsa` verb. This prevents users with this role from bypassing restricted PSA policies or deploying privileged workloads within their projects. If your organization requires users to retain this capability, administrators must create a custom project role that explicitly grants the `updatepsa` verb for the project resource. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10) |
+| [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10), [v2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14), and [v2.10.12](https://github.com/rancher/rancher/releases/tag/v2.10.12) |
 | [CVE-2025-62879](https://github.com/rancher/backup-restore-operator/security/advisories/GHSA-wj3p-5h3x-c74q) | Rancher now provides new versions of the Rancher Backup chart which prevent the leak of secret S3 credentials via the Rancher Backup pod log. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2025-67601](https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p) | Rancher now removes the ability to fetch CA certificates stored in Rancher’s setting `cacerts` when using the `login` command. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2023-32199](https://github.com/rancher/rancher/security/advisories/GHSA-j4vr-pcmw-hx59) | Rancher now removes the corresponding ClusterRoleBindings whenever the admin GlobalRole or its GlobalRoleBindings are deleted. Previously orphaned ClusterRoleBindings were marked with the annotation `authz.cluster.cattle.io/admin-globalrole-missing=true`. | 23 Oct 2025 | Rancher [v2.12.3](https://github.com/rancher/rancher/releases/tag/v2.12.3) and [v2.11.7](https://github.com/rancher/rancher/releases/tag/v2.11.7) |
@@ -20,6 +20,7 @@ Rancher 将 Rancher-Webhook 作为单独的 deployment 和服务部署在 local

 | Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
 |-----------------|-----------------|-----------------------|---------------------------|
+| v2.12.11        |     v0.8.7      | &check;               | &cross;                   |
 | v2.12.10        |     v0.8.6      | &check;               | &cross;                   |
 | v2.12.9         |     v0.8.5      | &check;               | &cross;                   |
 | v2.12.8         |     v0.8.5      | &check;               | &cross;                   |
@@ -16,6 +16,7 @@ Rancher 将在 GitHub 上发布的 Rancher 的[发版说明](https://github.com/

 | Patch 版本                                                         | 发布时间            |
 | ----------------------------------------------------------------- | ------------------ |
+| [2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7) | 2026 年 06 月 29 日 |
 | [2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6) | 2026 年 05 月 27 日 |
 | [2.13.5](https://github.com/rancher/rancher/releases/tag/v2.13.5) | 2026 年 04 月 30 日 |
 | [2.13.4](https://github.com/rancher/rancher/releases/tag/v2.13.4) | 2026 年 03 月 25 日 |
@@ -15,6 +15,7 @@ title: 安装 Adapter

 | Rancher 版本 | Adapter 版本 |
 |-----------------|------------------|
+| v2.13.7         |  108.0.0+up8.0.0 |
 | v2.13.6         |  108.0.0+up8.0.0 |
 | v2.13.5         |  108.0.0+up8.0.0 |
 | v2.13.4         |  108.0.0+up8.0.0 |
@@ -10,6 +10,12 @@ Rancher 致力于向社区披露我们产品的安全问题。我们会针对已

 | ID | 描述 | 日期 | 解决 |
 |----|-------------|------|------------|
+| [CVE-2026-44949](https://github.com/rancher/webhook/security/advisories/GHSA-h83p-cq95-vph4) | Fixed a security vulnerability in rancher-webhook where the FleetWorkspace mutating admission webhook performed side effects without authenticating requests, allowing a pod inside the cluster to create arbitrary namespaces and inject RBAC bindings. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-44947](https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc) | Fixed a security vulnerability in Rancher's legacy PRTB reconciler where removing the `updatepsa` permission from a RoleTemplate did not clean up stale PSA ClusterRole and ClusterRoleBinding resources, allowing affected users to retain unauthorized Pod Security Admission access indefinitely. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3) and Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7) |
+| [CVE-2026-44946](https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95) | Fixed a security vulnerability in Rancher's SAML authentication handler where a valid signed SAML response could be replayed by an attacker who had also captured the victim's pre-authentication SAML state cookie, allowing the attacker to create a separate authenticated session with the victim's permissions. All SAML providers (Okta, Ping, ADFS, Keycloak, Shibboleth) were affected. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-41053](https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh) | Fixed a security vulnerability in the GitHub App authentication provider where users incorrectly inherited permissions from all teams within their GitHub organization, rather than only the specific teams to which they belonged. Upon upgrading, Rancher automatically triggers a mandatory refresh of all affected user `principals` to remove these incorrectly assigned team memberships and restore proper access. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6) |
+| [CVE-2026-41052](https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744) | Updated the permissions of the built-in `project-owner` role to no longer include the `updatepsa` verb. This prevents users with this role from bypassing restricted PSA policies or deploying privileged workloads within their projects. If your organization requires users to retain this capability, administrators must create a custom project role that explicitly grants the `updatepsa` verb for the project resource. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10) |
+| [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10), [v2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14), and [v2.10.12](https://github.com/rancher/rancher/releases/tag/v2.10.12) |
 | [CVE-2025-62879](https://github.com/rancher/backup-restore-operator/security/advisories/GHSA-wj3p-5h3x-c74q) | Rancher now provides new versions of the Rancher Backup chart which prevent the leak of secret S3 credentials via the Rancher Backup pod log. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2025-67601](https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p) | Rancher now removes the ability to fetch CA certificates stored in Rancher’s setting `cacerts` when using the `login` command. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2023-32199](https://github.com/rancher/rancher/security/advisories/GHSA-j4vr-pcmw-hx59) | Rancher now removes the corresponding ClusterRoleBindings whenever the admin GlobalRole or its GlobalRoleBindings are deleted. Previously orphaned ClusterRoleBindings were marked with the annotation `authz.cluster.cattle.io/admin-globalrole-missing=true`. | 23 Oct 2025 | Rancher [v2.12.3](https://github.com/rancher/rancher/releases/tag/v2.12.3) and [v2.11.7](https://github.com/rancher/rancher/releases/tag/v2.11.7) |
@@ -20,6 +20,7 @@ Rancher 将 Rancher-Webhook 作为单独的 deployment 和服务部署在 local

 | Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
 |-----------------|-----------------|-----------------------|---------------------------|
+| v2.13.7         |     v0.9.6      | &check;               | &cross;                   |
 | v2.13.6         |     v0.9.5      | &check;               | &cross;                   |
 | v2.13.5         |     v0.9.4      | &check;               | &cross;                   |
 | v2.13.4         |     v0.9.3      | &check;               | &cross;                   |
@@ -12,6 +12,7 @@ Rancher 将在 GitHub 上发布的 Rancher 的[发版说明](https://github.com/

 | Patch 版本                                                         | 发布时间            |
 | ----------------------------------------------------------------- | ------------------ |
+| [2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3) | 2026 年 06 月 29 日  |
 | [2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2) | 2026 年 05 月 28 日 |
 | [2.14.1](https://github.com/rancher/rancher/releases/tag/v2.14.1) | 2026 年 04 月 30 日 |
 | [2.14.0](https://github.com/rancher/rancher/releases/tag/v2.14.0) | 2026 年 03 月 25 日 |
@@ -15,6 +15,7 @@ title: 安装 Adapter

 | Rancher 版本 | Adapter 版本 |
 |-----------------|------------------|
+| v2.14.3         |  109.0.0+up9.0.0 |
 | v2.14.2         |  109.0.0+up9.0.0 |
 | v2.14.1         |  109.0.0+up9.0.0 |
 | v2.14.0         |  109.0.0+up9.0.0 |
@@ -10,6 +10,12 @@ Rancher 致力于向社区披露我们产品的安全问题。我们会针对已

 | ID | 描述 | 日期 | 解决 |
 |----|-------------|------|------------|
+| [CVE-2026-44949](https://github.com/rancher/webhook/security/advisories/GHSA-h83p-cq95-vph4) | Fixed a security vulnerability in rancher-webhook where the FleetWorkspace mutating admission webhook performed side effects without authenticating requests, allowing a pod inside the cluster to create arbitrary namespaces and inject RBAC bindings. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-44947](https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc) | Fixed a security vulnerability in Rancher's legacy PRTB reconciler where removing the `updatepsa` permission from a RoleTemplate did not clean up stale PSA ClusterRole and ClusterRoleBinding resources, allowing affected users to retain unauthorized Pod Security Admission access indefinitely. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3) and Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7) |
+| [CVE-2026-44946](https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95) | Fixed a security vulnerability in Rancher's SAML authentication handler where a valid signed SAML response could be replayed by an attacker who had also captured the victim's pre-authentication SAML state cookie, allowing the attacker to create a separate authenticated session with the victim's permissions. All SAML providers (Okta, Ping, ADFS, Keycloak, Shibboleth) were affected. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-41053](https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh) | Fixed a security vulnerability in the GitHub App authentication provider where users incorrectly inherited permissions from all teams within their GitHub organization, rather than only the specific teams to which they belonged. Upon upgrading, Rancher automatically triggers a mandatory refresh of all affected user `principals` to remove these incorrectly assigned team memberships and restore proper access. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6) |
+| [CVE-2026-41052](https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744) | Updated the permissions of the built-in `project-owner` role to no longer include the `updatepsa` verb. This prevents users with this role from bypassing restricted PSA policies or deploying privileged workloads within their projects. If your organization requires users to retain this capability, administrators must create a custom project role that explicitly grants the `updatepsa` verb for the project resource. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10) |
+| [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10), [v2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14), and [v2.10.12](https://github.com/rancher/rancher/releases/tag/v2.10.12) |
 | [CVE-2025-62879](https://github.com/rancher/backup-restore-operator/security/advisories/GHSA-wj3p-5h3x-c74q) | Rancher now provides new versions of the Rancher Backup chart which prevent the leak of secret S3 credentials via the Rancher Backup pod log. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2025-67601](https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p) | Rancher now removes the ability to fetch CA certificates stored in Rancher’s setting `cacerts` when using the `login` command. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2023-32199](https://github.com/rancher/rancher/security/advisories/GHSA-j4vr-pcmw-hx59) | Rancher now removes the corresponding ClusterRoleBindings whenever the admin GlobalRole or its GlobalRoleBindings are deleted. Previously orphaned ClusterRoleBindings were marked with the annotation `authz.cluster.cattle.io/admin-globalrole-missing=true`. | 23 Oct 2025 | Rancher [v2.12.3](https://github.com/rancher/rancher/releases/tag/v2.12.3) and [v2.11.7](https://github.com/rancher/rancher/releases/tag/v2.11.7) |
@@ -20,7 +20,8 @@ Rancher 将 Rancher-Webhook 作为单独的 deployment 和服务部署在 local

 | Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
 |-----------------|-----------------|-----------------------|---------------------------|
-| v2.14.2         |    v0.10.5      | &check;               | &check;                   |
+| v2.14.3         |    v0.10.7      | &check;               | &check;                   |
+| v2.14.2         |    v0.10.6      | &check;               | &check;                   |
 | v2.14.1         |    v0.10.4      | &check;               | &check;                   |
 | v2.14.0         |    v0.10.0      | &cross;               | &check;                   |

@@ -3,8 +3,8 @@ The following table summarizes different GitHub metrics to give you an idea of e

 | Provider | Project | Stars | Forks | Contributors |
 | ---- | ---- | ---- | ---- | ---- |
-| Canal | https://github.com/projectcalico/canal | 723 | 97 | 20 |
+| Canal | https://github.com/projectcalico/canal | 721 | 96 | 20 |
 | Flannel | https://github.com/flannel-io/flannel | 9.5k | 2.9k | 249 |
-| Calico | https://github.com/projectcalico/calico | 7.2k | 1.6k | 412 |
-| Weave | https://github.com/weaveworks/weave | 6.6k | 675 | 82 |
-| Cilium | https://github.com/cilium/cilium | 24.4k | 3.8k | 1085 |
+| Calico | https://github.com/projectcalico/calico | 7.3k | 1.6k | 416 |
+| Weave | https://github.com/weaveworks/weave | 6.6k | 676 | 82 |
+| Cilium | https://github.com/cilium/cilium | 24.6k | 3.8k | 1108 |
@@ -17,9 +17,9 @@ Here you can find links to supporting documentation for the current released ver
    <th>Community</th>
  </tr>
  <tr>
-    <td><b>v2.14.2</b></td>
+    <td><b>v2.14.3</b></td>
    <td><a href="https://ranchermanager.docs.rancher.com/v2.14">Documentation</a></td>
-    <td><a href="https://github.com/rancher/rancher/releases/tag/v2.14.2">Release Notes</a></td>
+    <td><a href="https://github.com/rancher/rancher/releases/tag/v2.14.3">Release Notes</a></td>
    <td><center>N/A</center></td>
    <td><center>&#10003;</center></td>
    <td><center>&#10003;</center></td>
@@ -38,9 +38,9 @@ Here you can find links to supporting documentation for the current released ver
    <th>Community</th>
  </tr>
  <tr>
-    <td><b>v2.13.6</b></td>
+    <td><b>v2.13.7</b></td>
    <td><a href="https://ranchermanager.docs.rancher.com/v2.13">Documentation</a></td>
-    <td><a href="https://github.com/rancher/rancher/releases/tag/v2.13.6">Release Notes</a></td>
+    <td><a href="https://github.com/rancher/rancher/releases/tag/v2.13.7">Release Notes</a></td>
    <td><center>N/A</center></td>
    <td><center>&#10003;</center></td>
    <td><center>N/A</center></td>
@@ -59,9 +59,9 @@ Here you can find links to supporting documentation for the current released ver
    <th>Community</th>
  </tr>
  <tr>
-    <td><b>v2.12.10</b></td>
+    <td><b>v2.12.11</b></td>
    <td><a href="https://ranchermanager.docs.rancher.com/v2.12">Documentation</a></td>
-    <td><a href="https://github.com/rancher/rancher/releases/tag/v2.12.10">Release Notes</a></td>
+    <td><a href="https://github.com/rancher/rancher/releases/tag/v2.12.11">Release Notes</a></td>
    <td><center>N/A</center></td>
    <td><center>&#10003;</center></td>
    <td><center>N/A</center></td>
@@ -80,9 +80,9 @@ Here you can find links to supporting documentation for the current released ver
    <th>Community</th>
  </tr>
  <tr>
-    <td><b>v2.11.14</b></td>
+    <td><b>v2.11.15</b></td>
    <td><a href="https://ranchermanager.docs.rancher.com/v2.11">Documentation</a></td>
-    <td><a href="https://github.com/rancher/rancher/releases/tag/v2.11.14">Release Notes</a></td>
+    <td><a href="https://github.com/rancher/rancher/releases/tag/v2.11.15">Release Notes</a></td>
    <td><center>N/A</center></td>
    <td><center>&#10003;</center></td>
    <td><center>NA</center></td>
@@ -122,6 +122,14 @@ Here you can find links to supporting documentation for previous versions of Ran
    <th>Support Matrix</th>
    <th>Prime</th>
    <th>Community</th>
+  </tr>
+   <tr>
+    <td><b>v2.14.2</b></td>
+    <td><a href="https://ranchermanager.docs.rancher.com/v2.14">Documentation</a></td>
+    <td><a href="https://github.com/rancher/rancher/releases/tag/v2.14.2">Release Notes</a></td>
+    <td><center><a href="https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/rancher-v2-14-2/">Support Matrix</a></center></td>
+    <td><center>&#10003;</center></td>
+    <td><center>&#10003;</center></td>
  </tr>
  <tr>
    <td><b>v2.14.1</b></td>
@@ -152,6 +160,14 @@ Here you can find links to supporting documentation for previous versions of Ran
    <th>Prime</th>
    <th>Community</th>
  </tr>
+  <tr>
+    <td><b>v2.13.6</b></td>
+    <td><a href="https://ranchermanager.docs.rancher.com/v2.13">Documentation</a></td>
+    <td><a href="https://github.com/rancher/rancher/releases/tag/v2.13.6">Release Notes</a></td>
+    <td><center><a href="https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/rancher-v2-13-6/">Support Matrix</a></center></td>
+    <td><center>&#10003;</center></td>
+    <td><center>N/A</center></td>
+  </tr>
  <tr>
    <td><b>v2.13.5</b></td>
    <td><a href="https://ranchermanager.docs.rancher.com/v2.13">Documentation</a></td>
@@ -213,6 +229,14 @@ Here you can find links to supporting documentation for previous versions of Ran
    <th>Prime</th>
    <th>Community</th>
  </tr>
+  <tr>
+    <td><b>v2.12.10</b></td>
+    <td><a href="https://ranchermanager.docs.rancher.com/v2.12">Documentation</a></td>
+    <td><a href="https://github.com/rancher/rancher/releases/tag/v2.12.10">Release Notes</a></td>
+    <td><center><a href="https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/rancher-v2-12-10/">Support Matrix</a></center></td>
+    <td><center>&#10003;</center></td>
+    <td><center>N/A</center></td>
+  </tr>
  <tr>
    <td><b>v2.12.9</b></td>
    <td><a href="https://ranchermanager.docs.rancher.com/v2.12">Documentation</a></td>
@@ -306,6 +330,14 @@ Here you can find links to supporting documentation for previous versions of Ran
    <th>Prime</th>
    <th>Community</th>
  </tr>
+  <tr>
+    <td><b>v2.11.14</b></td>
+    <td><a href="https://ranchermanager.docs.rancher.com/v2.11">Documentation</a></td>
+    <td><a href="https://github.com/rancher/rancher/releases/tag/v2.11.14">Release Notes</a></td>
+    <td><center><a href="https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/rancher-v2-11-14/">Support Matrix</a></center></td>
+    <td><center>&#10003;</center></td>
+    <td><center>NA</center></td>
+  </tr>
  <tr>
    <td><b>v2.11.13</b></td>
    <td><a href="https://ranchermanager.docs.rancher.com/v2.11">Documentation</a></td>
@@ -1,11 +1,18 @@
 ---
-title: Rancher Prime AWS Marketplace Quick Start
-description: Deploy SUSE Rancher from the AWS Marketplace listing.
+title: Rancher for AWS
+description: Learn about Rancher for AWS from the AWS Marketplace listing.
 ---

 <head>
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace"/>
 </head>

-You can quickly deploy Rancher Prime on Amazon Elastic Kubernetes Service (EKS.) To learn more, see the [instructions](https://suse-enceladus.github.io/marketplace-docs/rancher-prime/aws/?repository=rancher-payg-billing-adapter-llc-prd) under Usage Information in the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-f2bvszurj2p2c). 
+SUSE Rancher for AWS (SRA/SRFA) is a fully managed Software-as-a-Service (SaaS) offering available through the [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-yrzugbpzuukww). It provides a centralized control plane to manage, monitor, and scale Kubernetes clusters within an AWS environment.

+For deployment prerequisites, architecture requirements, and subscription details, refer to the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-yrzugbpzuukww). For more information, refer to the [product documentation](https://documentation.suse.com/cloudnative/rancher-srfa/).
+
+:::note
+
+SUSE Rancher for AWS is an offering distinct from deploying and managing the Rancher server manually on Amazon EKS. If you intend to install and manage your own Rancher deployment on an EKS cluster, refer to [Installing Rancher on Amazon EKS](../../installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md).
+
+:::
@@ -10,6 +10,7 @@ Rancher is committed to informing the community of security issues in our produc

 | ID | Description | Date | Resolution |
 |----|-------------|------|------------|
+| [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10), [v2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14), and [v2.10.12](https://github.com/rancher/rancher/releases/tag/v2.10.12) |
 | [CVE-2025-62879](https://github.com/rancher/backup-restore-operator/security/advisories/GHSA-wj3p-5h3x-c74q) | Rancher now provides new versions of the Rancher Backup chart which prevent the leak of secret S3 credentials via the Rancher Backup pod log. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2025-67601](https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p) | Rancher now removes the ability to fetch CA certificates stored in Rancher’s setting `cacerts` when using the `login` command. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2024-58260](https://github.com/rancher/rancher/security/advisories/GHSA-q82v-h4rq-5c86) | Setting the username of one user as the same username of another user causes an error when either user attempts to log in. Therefore, a user with the `Manage Users` permission could potentially deny any user, including admins, from logging in. To prevent this, usernames have been made immutable once set, and it is not possible to update or create a user with a username that is already in use. | 25 Sep 2025 | Rancher [v2.12.2](https://github.com/rancher/rancher/releases/tag/v2.12.2), [v2.11.6](https://github.com/rancher/rancher/releases/tag/v2.11.6), [v2.10.10](https://github.com/rancher/rancher/releases/tag/v2.10.10), and [v2.9.12](https://github.com/rancher/rancher/releases/tag/v2.9.12) |
@@ -12,6 +12,7 @@ Rancher will publish deprecated features as part of the [release notes](https://

 | Patch Version |  Release Date |
 |---------------|---------------|
+| [2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) | June 29, 2026 |
 | [2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14) | May 27, 2026 |
 | [2.11.13](https://github.com/rancher/rancher/releases/tag/v2.11.13) | April 30, 2026 |
 | [2.11.12](https://github.com/rancher/rancher/releases/tag/v2.11.12) | March 25, 2026 |
@@ -1,11 +1,18 @@
 ---
-title: Rancher Prime AWS Marketplace Quick Start
-description: Deploy SUSE Rancher from the AWS Marketplace listing.
+title: Rancher for AWS
+description: Learn about Rancher for AWS from the AWS Marketplace listing.
 ---

 <head>
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace"/>
 </head>

-You can quickly deploy Rancher Prime on Amazon Elastic Kubernetes Service (EKS.) To learn more, see the [instructions](https://suse-enceladus.github.io/marketplace-docs/rancher-prime/aws/?repository=rancher-payg-billing-adapter-llc-prd) under Usage Information in the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-f2bvszurj2p2c). 
+SUSE Rancher for AWS (SRA/SRFA) is a fully managed Software-as-a-Service (SaaS) offering available through the [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-yrzugbpzuukww). It provides a centralized control plane to manage, monitor, and scale Kubernetes clusters within an AWS environment.

+For deployment prerequisites, architecture requirements, and subscription details, refer to the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-yrzugbpzuukww). For more information, refer to the [product documentation](https://documentation.suse.com/cloudnative/rancher-srfa/).
+
+:::note
+
+SUSE Rancher for AWS is an offering distinct from deploying and managing the Rancher server manually on Amazon EKS. If you intend to install and manage your own Rancher deployment on an EKS cluster, refer to [Installing Rancher on Amazon EKS](../../installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md).
+
+:::
@@ -19,6 +19,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers

 | Rancher Version | Adapter Version  |
 |-----------------|------------------|
+| v2.11.15        | v106.0.1+up6.0.1 |
 | v2.11.14        | v106.0.1+up6.0.1 |
 | v2.11.13        | v106.0.0+up6.0.0 |
 | v2.11.12        | v106.0.0+up6.0.0 |
@@ -10,6 +10,9 @@ Rancher is committed to informing the community of security issues in our produc

 | ID | Description | Date | Resolution |
 |----|-------------|------|------------|
+| [CVE-2026-44949](https://github.com/rancher/webhook/security/advisories/GHSA-h83p-cq95-vph4) | Fixed a security vulnerability in rancher-webhook where the FleetWorkspace mutating admission webhook performed side effects without authenticating requests, allowing a pod inside the cluster to create arbitrary namespaces and inject RBAC bindings. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-44946](https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95) | Fixed a security vulnerability in Rancher's SAML authentication handler where a valid signed SAML response could be replayed by an attacker who had also captured the victim's pre-authentication SAML state cookie, allowing the attacker to create a separate authenticated session with the victim's permissions. All SAML providers (Okta, Ping, ADFS, Keycloak, Shibboleth) were affected. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10), [v2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14), and [v2.10.12](https://github.com/rancher/rancher/releases/tag/v2.10.12) |
 | [CVE-2026-25705](https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35) | Rancher now protects against arbitrary file access via path traversal in Rancher Extensions. Note by default only users with administrative permissions can deploy UI extensions unless explicit permission is granted to other users. | 30 Apr 2026 | Rancher [v2.14.1](https://github.com/rancher/rancher/releases/tag/v2.14.1), [v2.13.5](https://github.com/rancher/rancher/releases/tag/v2.13.5), [v2.12.9](https://github.com/rancher/rancher/releases/tag/v2.12.9), and [v2.11.13](https://github.com/rancher/rancher/releases/tag/v2.11.13) |
 | [CVE-2025-62879](https://github.com/rancher/backup-restore-operator/security/advisories/GHSA-wj3p-5h3x-c74q) | Rancher now provides new versions of the Rancher Backup chart which prevent the leak of secret S3 credentials via the Rancher Backup pod log. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2025-67601](https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p) | Rancher now removes the ability to fetch CA certificates stored in Rancher’s setting `cacerts` when using the `login` command. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
@@ -20,6 +20,7 @@ Each Rancher version is designed to be compatible with a single version of the w

 | Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
 |-----------------|-----------------|-----------------------|---------------------------|
+| v2.11.15        |     v0.7.10     | &check;               | &cross;                   |
 | v2.11.14        |     v0.7.9      | &check;               | &cross;                   |
 | v2.11.13        |     v0.7.8      | &check;               | &cross;                   |
 | v2.11.12        |     v0.7.8      | &check;               | &cross;                   |
@@ -12,6 +12,7 @@ Rancher will publish deprecated features as part of the [release notes](https://

 | Patch Version |  Release Date |
 |---------------|---------------|
+| [2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) | June 29, 2026 |
 | [2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10) | May 27, 2026 |
 | [2.12.9](https://github.com/rancher/rancher/releases/tag/v2.12.9) | April 30, 2026 |
 | [2.12.8](https://github.com/rancher/rancher/releases/tag/v2.12.8) | March 25, 2026 |
@@ -1,11 +1,18 @@
 ---
-title: Rancher Prime AWS Marketplace Quick Start
-description: Deploy SUSE Rancher from the AWS Marketplace listing.
+title: Rancher for AWS
+description: Learn about Rancher for AWS from the AWS Marketplace listing.
 ---

 <head>
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace"/>
 </head>

-You can quickly deploy Rancher Prime on Amazon Elastic Kubernetes Service (EKS.) To learn more, see the [instructions](https://suse-enceladus.github.io/marketplace-docs/rancher-prime/aws/?repository=rancher-payg-billing-adapter-llc-prd) under Usage Information in the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-f2bvszurj2p2c). 
+SUSE Rancher for AWS (SRA/SRFA) is a fully managed Software-as-a-Service (SaaS) offering available through the [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-yrzugbpzuukww). It provides a centralized control plane to manage, monitor, and scale Kubernetes clusters within an AWS environment.

+For deployment prerequisites, architecture requirements, and subscription details, refer to the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-yrzugbpzuukww). For more information, refer to the [product documentation](https://documentation.suse.com/cloudnative/rancher-srfa/).
+
+:::note
+
+SUSE Rancher for AWS is an offering distinct from deploying and managing the Rancher server manually on Amazon EKS. If you intend to install and manage your own Rancher deployment on an EKS cluster, refer to [Installing Rancher on Amazon EKS](../../installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md).
+
+:::
@@ -19,6 +19,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers

 | Rancher Version | Adapter Version  |
 |-----------------|------------------|
+| v2.12.11         |  107.0.0+up7.0.0 |
 | v2.12.10         |  107.0.0+up7.0.0 |
 | v2.12.9         |  107.0.0+up7.0.0 |
 | v2.12.8         |  107.0.0+up7.0.0 |
@@ -104,7 +104,8 @@ Each self-assessment guide is accompanied by a hardening guide. These guides wer
 | Standalone RKE2 | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.rke2.io/security/cis_self_assessment18) | [Link](https://docs.rke2.io/security/hardening_guide) |
 | Standalone RKE2 | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.rke2.io/security/cis_self_assessment19) | [Link](https://docs.rke2.io/security/hardening_guide) |
 | Standalone RKE2 | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.rke2.io/security/cis_self_assessment110) | [Link](https://docs.rke2.io/security/hardening_guide) |
-| Standalone RKE2 | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.rke2.io/security/cis_self_assessment111) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.29 to v1.31 | CIS v1.11 | [Link](https://docs.rke2.io/security/cis_self_assessment111) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.32 and above | CIS v1.12 | [Link](https://docs.rke2.io/security/cis_self_assessment112) | [Link](https://docs.rke2.io/security/hardening_guide) |

 ### K3s Guides

@@ -113,4 +114,5 @@ Each self-assessment guide is accompanied by a hardening guide. These guides wer
 | Standalone K3s | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.k3s.io/security/self-assessment-1.8) | [Link](https://docs.k3s.io/security/hardening-guide) |
 | Standalone K3s | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.k3s.io/security/self-assessment-1.9) | [Link](https://docs.k3s.io/security/hardening-guide) |
 | Standalone K3s | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.k3s.io/security/self-assessment-1.10) | [Link](https://docs.k3s.io/security/hardening-guide) |
-| Standalone K3s | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.k3s.io/security/self-assessment-1.11) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.29 to v1.31 | CIS v1.11 | [Link](https://docs.k3s.io/security/self-assessment-1.11) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.32 and above | CIS v1.12 | [Link](https://docs.k3s.io/security/self-assessment-1.12) | [Link](https://docs.k3s.io/security/hardening-guide) |
@@ -10,6 +10,10 @@ Rancher is committed to informing the community of security issues in our produc

 | ID | Description | Date | Resolution |
 |----|-------------|------|------------|
+| [CVE-2026-44949](https://github.com/rancher/webhook/security/advisories/GHSA-h83p-cq95-vph4) | Fixed a security vulnerability in rancher-webhook where the FleetWorkspace mutating admission webhook performed side effects without authenticating requests, allowing a pod inside the cluster to create arbitrary namespaces and inject RBAC bindings. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-44946](https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95) | Fixed a security vulnerability in Rancher's SAML authentication handler where a valid signed SAML response could be replayed by an attacker who had also captured the victim's pre-authentication SAML state cookie, allowing the attacker to create a separate authenticated session with the victim's permissions. All SAML providers (Okta, Ping, ADFS, Keycloak, Shibboleth) were affected. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-41052](https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744) | Updated the permissions of the built-in `project-owner` role to no longer include the `updatepsa` verb. This prevents users with this role from bypassing restricted PSA policies or deploying privileged workloads within their projects. If your organization requires users to retain this capability, administrators must create a custom project role that explicitly grants the `updatepsa` verb for the project resource. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10) |
+| [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10), [v2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14), and [v2.10.12](https://github.com/rancher/rancher/releases/tag/v2.10.12) |
 | [CVE-2026-25705](https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35) | Rancher now protects against arbitrary file access via path traversal in Rancher Extensions. Note by default only users with administrative permissions can deploy UI extensions unless explicit permission is granted to other users. | 30 Apr 2026 | Rancher [v2.14.1](https://github.com/rancher/rancher/releases/tag/v2.14.1), [v2.13.5](https://github.com/rancher/rancher/releases/tag/v2.13.5), [v2.12.9](https://github.com/rancher/rancher/releases/tag/v2.12.9), and [v2.11.13](https://github.com/rancher/rancher/releases/tag/v2.11.13) |
 | [CVE-2025-62879](https://github.com/rancher/backup-restore-operator/security/advisories/GHSA-wj3p-5h3x-c74q) | Rancher now provides new versions of the Rancher Backup chart which prevent the leak of secret S3 credentials via the Rancher Backup pod log. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2025-67601](https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p) | Rancher now removes the ability to fetch CA certificates stored in Rancher’s setting `cacerts` when using the `login` command. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
@@ -20,6 +20,7 @@ Each Rancher version is designed to be compatible with a single version of the w

 | Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
 |-----------------|-----------------|-----------------------|---------------------------|
+| v2.12.11        |     v0.8.7      | &check;               | &cross;                   |
 | v2.12.10        |     v0.8.6      | &check;               | &cross;                   |
 | v2.12.9         |     v0.8.5      | &check;               | &cross;                   |
 | v2.12.8         |     v0.8.5      | &check;               | &cross;                   |
@@ -12,6 +12,7 @@ Rancher will publish deprecated features as part of the [release notes](https://

 | Patch Version |  Release Date |
 |---------------|---------------|
+| [2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7) | June 29, 2026 |
 | [2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6) | May 27, 2026 |
 | [2.13.5](https://github.com/rancher/rancher/releases/tag/v2.13.5) | April 30, 2026 |
 | [2.13.4](https://github.com/rancher/rancher/releases/tag/v2.13.4) | March 25, 2026 |
@@ -1,11 +1,18 @@
 ---
-title: Rancher Prime AWS Marketplace Quick Start
-description: Deploy SUSE Rancher from the AWS Marketplace listing.
+title: Rancher for AWS
+description: Learn about Rancher for AWS from the AWS Marketplace listing.
 ---

 <head>
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace"/>
 </head>

-You can quickly deploy Rancher Prime on Amazon Elastic Kubernetes Service (EKS.) To learn more, see the [instructions](https://suse-enceladus.github.io/marketplace-docs/rancher-prime/aws/?repository=rancher-payg-billing-adapter-llc-prd) under Usage Information in the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-f2bvszurj2p2c). 
+SUSE Rancher for AWS (SRA/SRFA) is a fully managed Software-as-a-Service (SaaS) offering available through the [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-yrzugbpzuukww). It provides a centralized control plane to manage, monitor, and scale Kubernetes clusters within an AWS environment.

+For deployment prerequisites, architecture requirements, and subscription details, refer to the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-yrzugbpzuukww). For more information, refer to the [product documentation](https://documentation.suse.com/cloudnative/rancher-srfa/).
+
+:::note
+
+SUSE Rancher for AWS is an offering distinct from deploying and managing the Rancher server manually on Amazon EKS. If you intend to install and manage your own Rancher deployment on an EKS cluster, refer to [Installing Rancher on Amazon EKS](../../installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md).
+
+:::
@@ -19,6 +19,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers

 | Rancher Version | Adapter Version  |
 |-----------------|------------------|
+| v2.13.7         |  108.0.0+up8.0.0 |
 | v2.13.6         |  108.0.0+up8.0.0 |
 | v2.13.5         |  108.0.0+up8.0.0 |
 | v2.13.4         |  108.0.0+up8.0.0 |
@@ -104,7 +104,8 @@ Each self-assessment guide is accompanied by a hardening guide. These guides wer
 | Standalone RKE2 | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.rke2.io/security/cis_self_assessment18) | [Link](https://docs.rke2.io/security/hardening_guide) |
 | Standalone RKE2 | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.rke2.io/security/cis_self_assessment19) | [Link](https://docs.rke2.io/security/hardening_guide) |
 | Standalone RKE2 | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.rke2.io/security/cis_self_assessment110) | [Link](https://docs.rke2.io/security/hardening_guide) |
-| Standalone RKE2 | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.rke2.io/security/cis_self_assessment111) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.29 to v1.31 | CIS v1.11 | [Link](https://docs.rke2.io/security/cis_self_assessment111) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.32 and above | CIS v1.12 | [Link](https://docs.rke2.io/security/cis_self_assessment112) | [Link](https://docs.rke2.io/security/hardening_guide) |

 ### K3s Guides

@@ -113,4 +114,6 @@ Each self-assessment guide is accompanied by a hardening guide. These guides wer
 | Standalone K3s | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.k3s.io/security/self-assessment-1.8) | [Link](https://docs.k3s.io/security/hardening-guide) |
 | Standalone K3s | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.k3s.io/security/self-assessment-1.9) | [Link](https://docs.k3s.io/security/hardening-guide) |
 | Standalone K3s | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.k3s.io/security/self-assessment-1.10) | [Link](https://docs.k3s.io/security/hardening-guide) |
-| Standalone K3s | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.k3s.io/security/self-assessment-1.11) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.29 to v1.31 | CIS v1.11 | [Link](https://docs.k3s.io/security/self-assessment-1.11) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.32 and above | CIS v1.12 | [Link](https://docs.k3s.io/security/self-assessment-1.12) | [Link](https://docs.k3s.io/security/hardening-guide) |
+
@@ -10,6 +10,12 @@ Rancher is committed to informing the community of security issues in our produc

 | ID | Description | Date | Resolution |
 |----|-------------|------|------------|
+| [CVE-2026-44949](https://github.com/rancher/webhook/security/advisories/GHSA-h83p-cq95-vph4) | Fixed a security vulnerability in rancher-webhook where the FleetWorkspace mutating admission webhook performed side effects without authenticating requests, allowing a pod inside the cluster to create arbitrary namespaces and inject RBAC bindings. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-44947](https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc) | Fixed a security vulnerability in Rancher's legacy PRTB reconciler where removing the `updatepsa` permission from a RoleTemplate did not clean up stale PSA ClusterRole and ClusterRoleBinding resources, allowing affected users to retain unauthorized Pod Security Admission access indefinitely. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3) and Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7) |
+| [CVE-2026-44946](https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95) | Fixed a security vulnerability in Rancher's SAML authentication handler where a valid signed SAML response could be replayed by an attacker who had also captured the victim's pre-authentication SAML state cookie, allowing the attacker to create a separate authenticated session with the victim's permissions. All SAML providers (Okta, Ping, ADFS, Keycloak, Shibboleth) were affected. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-41053](https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh) | Fixed a security vulnerability in the GitHub App authentication provider where users incorrectly inherited permissions from all teams within their GitHub organization, rather than only the specific teams to which they belonged. Upon upgrading, Rancher automatically triggers a mandatory refresh of all affected user `principals` to remove these incorrectly assigned team memberships and restore proper access. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6) |
+| [CVE-2026-41052](https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744) | Updated the permissions of the built-in `project-owner` role to no longer include the `updatepsa` verb. This prevents users with this role from bypassing restricted PSA policies or deploying privileged workloads within their projects. If your organization requires users to retain this capability, administrators must create a custom project role that explicitly grants the `updatepsa` verb for the project resource. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10) |
+| [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10), [v2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14), and [v2.10.12](https://github.com/rancher/rancher/releases/tag/v2.10.12) |
 | [CVE-2026-25705](https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35) | Rancher now protects against arbitrary file access via path traversal in Rancher Extensions. Note by default only users with administrative permissions can deploy UI extensions unless explicit permission is granted to other users. | 30 Apr 2026 | Rancher [v2.14.1](https://github.com/rancher/rancher/releases/tag/v2.14.1), [v2.13.5](https://github.com/rancher/rancher/releases/tag/v2.13.5), [v2.12.9](https://github.com/rancher/rancher/releases/tag/v2.12.9), and [v2.11.13](https://github.com/rancher/rancher/releases/tag/v2.11.13) |
 | [CVE-2025-62879](https://github.com/rancher/backup-restore-operator/security/advisories/GHSA-wj3p-5h3x-c74q) | Rancher now provides new versions of the Rancher Backup chart which prevent the leak of secret S3 credentials via the Rancher Backup pod log. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2025-67601](https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p) | Rancher now removes the ability to fetch CA certificates stored in Rancher’s setting `cacerts` when using the `login` command. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
@@ -8,6 +8,12 @@ title: About rancher-selinux

 To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM.

+:::tip Why SELinux?
+
+By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised.
+
+:::
+
 The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled.

 The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux)
@@ -16,7 +22,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra

 :::note Requirement:

-The `rancher-selinux` RPM was tested on openSUSE Tumbleweed and RHEL-based distributions including Centos/RockyLinux 8 and 9. 
+The `rancher-selinux` RPM was tested on openSUSE MicroOS, Fedora 42, and RHEL-based distributions including CentOS/RockyLinux 8, 9, and 10.

 :::

@@ -50,6 +56,19 @@ gpgkey=https://rpm.rancher.io/public.key
 EOF
 ```

+In order to use the RPM repository, on a CentOS 10 or RHEL 10 system, run the following bash snippet:
+
+```
+# cat << EOF > /etc/yum.repos.d/rancher.repo 
+[rancher] 
+name=Rancher 
+baseurl=https://rpm.rancher.io/rancher/production/centos/10/noarch
+enabled=1 
+gpgcheck=1 
+gpgkey=https://rpm.rancher.io/public.key 
+EOF
+```
+
 ### 2. Installing the RPM

 Install the RPM:
@@ -58,14 +77,16 @@ Install the RPM:
 yum -y install rancher-selinux
 ```

-## Configuring the Logging and Monitoring Applications to Work with SELinux
+## Configuring Applications to Work with SELinux

 :::note Requirement:

-Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, and Tumbleweed.
+Logging v2, Monitoring v2, and Rancher AI were tested with SELinux on RHEL/CentOS 8, 9, 10, and Tumbleweed.

 :::

-Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM. 
+The `rancher-selinux` RPM currently covers the following charts: **Logging**, **Monitoring**, and **Rancher AI**.

-To configure the `rancher-logging` or the `rancher-monitoring` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts.
+Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM.
+
+To configure these charts to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts.
@@ -20,6 +20,7 @@ Each Rancher version is designed to be compatible with a single version of the w

 | Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
 |-----------------|-----------------|-----------------------|---------------------------|
+| v2.13.7         |     v0.9.6      | &check;               | &cross;                   |
 | v2.13.6         |     v0.9.5      | &check;               | &cross;                   |
 | v2.13.5         |     v0.9.4      | &check;               | &cross;                   |
 | v2.13.4         |     v0.9.3      | &check;               | &cross;                   |
@@ -12,6 +12,7 @@ Rancher will publish deprecated features as part of the [release notes](https://

 | Patch Version |  Release Date |
 |---------------|---------------|
+| [2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3) | June 29, 2026  |
 | [2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2) | May 28, 2026   |
 | [2.14.1](https://github.com/rancher/rancher/releases/tag/v2.14.1) | April 30, 2026 |
 | [2.14.0](https://github.com/rancher/rancher/releases/tag/v2.14.0) | March 25, 2026 |
@@ -1,11 +1,18 @@
 ---
-title: Rancher Prime AWS Marketplace Quick Start
-description: Deploy SUSE Rancher from the AWS Marketplace listing.
+title: Rancher for AWS
+description: Learn about Rancher for AWS from the AWS Marketplace listing.
 ---

 <head>
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace"/>
 </head>

-You can quickly deploy Rancher Prime on Amazon Elastic Kubernetes Service (EKS.) To learn more, see the [instructions](https://suse-enceladus.github.io/marketplace-docs/rancher-prime/aws/?repository=rancher-payg-billing-adapter-llc-prd) under Usage Information in the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-f2bvszurj2p2c). 
+SUSE Rancher for AWS (SRA/SRFA) is a fully managed Software-as-a-Service (SaaS) offering available through the [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-yrzugbpzuukww). It provides a centralized control plane to manage, monitor, and scale Kubernetes clusters within an AWS environment.

+For deployment prerequisites, architecture requirements, and subscription details, refer to the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-yrzugbpzuukww). For more information, refer to the [product documentation](https://documentation.suse.com/cloudnative/rancher-srfa/).
+
+:::note
+
+SUSE Rancher for AWS is an offering distinct from deploying and managing the Rancher server manually on Amazon EKS. If you intend to install and manage your own Rancher deployment on an EKS cluster, refer to [Installing Rancher on Amazon EKS](../../installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md).
+
+:::
@@ -19,6 +19,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers

 | Rancher Version | Adapter Version  |
 |-----------------|------------------|
+| v2.14.3         |  109.0.0+up9.0.0 |
 | v2.14.2         |  109.0.0+up9.0.0 |
 | v2.14.1         |  109.0.0+up9.0.0 |
 | v2.14.0         |  109.0.0+up9.0.0 |
@@ -104,7 +104,8 @@ Each self-assessment guide is accompanied by a hardening guide. These guides wer
 | Standalone RKE2 | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.rke2.io/security/cis_self_assessment18) | [Link](https://docs.rke2.io/security/hardening_guide) |
 | Standalone RKE2 | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.rke2.io/security/cis_self_assessment19) | [Link](https://docs.rke2.io/security/hardening_guide) |
 | Standalone RKE2 | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.rke2.io/security/cis_self_assessment110) | [Link](https://docs.rke2.io/security/hardening_guide) |
-| Standalone RKE2 | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.rke2.io/security/cis_self_assessment111) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.29 to v1.31 | CIS v1.11 | [Link](https://docs.rke2.io/security/cis_self_assessment111) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.32 and above | CIS v1.12 | [Link](https://docs.rke2.io/security/cis_self_assessment112) | [Link](https://docs.rke2.io/security/hardening_guide) |

 ### K3s Guides

@@ -113,4 +114,6 @@ Each self-assessment guide is accompanied by a hardening guide. These guides wer
 | Standalone K3s | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.k3s.io/security/self-assessment-1.8) | [Link](https://docs.k3s.io/security/hardening-guide) |
 | Standalone K3s | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.k3s.io/security/self-assessment-1.9) | [Link](https://docs.k3s.io/security/hardening-guide) |
 | Standalone K3s | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.k3s.io/security/self-assessment-1.10) | [Link](https://docs.k3s.io/security/hardening-guide) |
-| Standalone K3s | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.k3s.io/security/self-assessment-1.11) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.29 to v1.31 | CIS v1.11 | [Link](https://docs.k3s.io/security/self-assessment-1.11) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.32 and above | CIS v1.12 | [Link](https://docs.k3s.io/security/self-assessment-1.12) | [Link](https://docs.k3s.io/security/hardening-guide) |
+
@@ -10,6 +10,12 @@ Rancher is committed to informing the community of security issues in our produc

 | ID | Description | Date | Resolution |
 |----|-------------|------|------------|
+| [CVE-2026-44949](https://github.com/rancher/webhook/security/advisories/GHSA-h83p-cq95-vph4) | Fixed a security vulnerability in rancher-webhook where the FleetWorkspace mutating admission webhook performed side effects without authenticating requests, allowing a pod inside the cluster to create arbitrary namespaces and inject RBAC bindings. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-44947](https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc) | Fixed a security vulnerability in Rancher's legacy PRTB reconciler where removing the `updatepsa` permission from a RoleTemplate did not clean up stale PSA ClusterRole and ClusterRoleBinding resources, allowing affected users to retain unauthorized Pod Security Admission access indefinitely. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3) and Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7) |
+| [CVE-2026-44946](https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95) | Fixed a security vulnerability in Rancher's SAML authentication handler where a valid signed SAML response could be replayed by an attacker who had also captured the victim's pre-authentication SAML state cookie, allowing the attacker to create a separate authenticated session with the victim's permissions. All SAML providers (Okta, Ping, ADFS, Keycloak, Shibboleth) were affected. | 29 June 2026 | Rancher [v2.14.3](https://github.com/rancher/rancher/releases/tag/v2.14.3), Rancher [v2.13.7](https://github.com/rancher/rancher/releases/tag/v2.13.7), Rancher [v2.12.11](https://github.com/rancher/rancher/releases/tag/v2.12.11) and Rancher [v2.11.15](https://github.com/rancher/rancher/releases/tag/v2.11.15) |
+| [CVE-2026-41053](https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh) | Fixed a security vulnerability in the GitHub App authentication provider where users incorrectly inherited permissions from all teams within their GitHub organization, rather than only the specific teams to which they belonged. Upon upgrading, Rancher automatically triggers a mandatory refresh of all affected user `principals` to remove these incorrectly assigned team memberships and restore proper access. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6) |
+| [CVE-2026-41052](https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744) | Updated the permissions of the built-in `project-owner` role to no longer include the `updatepsa` verb. This prevents users with this role from bypassing restricted PSA policies or deploying privileged workloads within their projects. If your organization requires users to retain this capability, administrators must create a custom project role that explicitly grants the `updatepsa` verb for the project resource. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10) |
+| [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. | 27 May 2026 | Rancher [v2.14.2](https://github.com/rancher/rancher/releases/tag/v2.14.2), Rancher [v2.13.6](https://github.com/rancher/rancher/releases/tag/v2.13.6), [v2.12.10](https://github.com/rancher/rancher/releases/tag/v2.12.10), [v2.11.14](https://github.com/rancher/rancher/releases/tag/v2.11.14), and [v2.10.12](https://github.com/rancher/rancher/releases/tag/v2.10.12) |
 | [CVE-2026-25705](https://github.com/rancher/rancher/security/advisories/GHSA-5v3h-x4wf-5c35) | Rancher now protects against arbitrary file access via path traversal in Rancher Extensions. Note by default only users with administrative permissions can deploy UI extensions unless explicit permission is granted to other users. | 30 Apr 2026 | Rancher [v2.14.1](https://github.com/rancher/rancher/releases/tag/v2.14.1), [v2.13.5](https://github.com/rancher/rancher/releases/tag/v2.13.5), [v2.12.9](https://github.com/rancher/rancher/releases/tag/v2.12.9), and [v2.11.13](https://github.com/rancher/rancher/releases/tag/v2.11.13) |
 | [CVE-2025-62879](https://github.com/rancher/backup-restore-operator/security/advisories/GHSA-wj3p-5h3x-c74q) | Rancher now provides new versions of the Rancher Backup chart which prevent the leak of secret S3 credentials via the Rancher Backup pod log. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
 | [CVE-2025-67601](https://github.com/rancher/rancher/security/advisories/GHSA-mc24-7m59-4q5p) | Rancher now removes the ability to fetch CA certificates stored in Rancher’s setting `cacerts` when using the `login` command. | 29 Jan 2026 | Rancher [v2.13.2](https://github.com/rancher/rancher/releases/tag/v2.13.2), [v2.12.6](https://github.com/rancher/rancher/releases/tag/v2.12.6), [v2.11.10](https://github.com/rancher/rancher/releases/tag/v2.11.10), and [v2.10.11](https://github.com/rancher/rancher/releases/tag/v2.10.11) |
@@ -8,6 +8,12 @@ title: About rancher-selinux

 To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM.

+:::tip Why SELinux?
+
+By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised.
+
+:::
+
 The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled.

 The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux)
@@ -16,7 +22,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra

 :::note Requirement:

-The `rancher-selinux` RPM was tested on openSUSE Tumbleweed and RHEL-based distributions including Centos/RockyLinux 8 and 9. 
+The `rancher-selinux` RPM was tested on openSUSE MicroOS, Fedora 42, and RHEL-based distributions including CentOS/RockyLinux 8, 9, and 10.

 :::

@@ -50,6 +56,19 @@ gpgkey=https://rpm.rancher.io/public.key
 EOF
 ```

+In order to use the RPM repository, on a CentOS 10 or RHEL 10 system, run the following bash snippet:
+
+```
+# cat << EOF > /etc/yum.repos.d/rancher.repo 
+[rancher] 
+name=Rancher 
+baseurl=https://rpm.rancher.io/rancher/production/centos/10/noarch
+enabled=1 
+gpgcheck=1 
+gpgkey=https://rpm.rancher.io/public.key 
+EOF
+```
+
 ### 2. Installing the RPM

 Install the RPM:
@@ -58,14 +77,16 @@ Install the RPM:
 yum -y install rancher-selinux
 ```

-## Configuring the Logging and Monitoring Applications to Work with SELinux
+## Configuring Applications to Work with SELinux

 :::note Requirement:

-Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, and Tumbleweed.
+Logging v2, Monitoring v2, and Rancher AI were tested with SELinux on RHEL/CentOS 8, 9, 10, and Tumbleweed.

 :::

-Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM. 
+The `rancher-selinux` RPM currently covers the following charts: **Logging**, **Monitoring**, and **Rancher AI**.

-To configure the `rancher-logging` or the `rancher-monitoring` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts.
+Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM.
+
+To configure these charts to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts.
@@ -20,7 +20,8 @@ Each Rancher version is designed to be compatible with a single version of the w

 | Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
 |-----------------|-----------------|-----------------------|---------------------------|
-| v2.14.2         |    v0.10.5      | &check;               | &check;                   |
+| v2.14.3         |    v0.10.7      | &check;               | &check;                   |
+| v2.14.2         |    v0.10.6      | &check;               | &check;                   |
 | v2.14.1         |    v0.10.4      | &check;               | &check;                   |
 | v2.14.0         |    v0.10.0      | &cross;               | &check;                   |
Author	SHA1	Message	Date
Billy Tat	3f484a4eeb	Merge pull request #2365 from btat/june-cves Add June CVEs	2026-06-29 17:36:01 -07:00
Billy Tat	8e6e56c616	Add June CVEs	2026-06-29 17:08:27 -07:00
Billy Tat	877d8d64a4	Merge pull request #2354 from rancher/v2.11.15 Merge release v2.11.15 to main	2026-06-29 15:26:42 -07:00
Billy Tat	366203efce	Merge pull request #2353 from rancher/v2.12.11 Merge release v2.12.11 to main	2026-06-29 15:26:15 -07:00
Billy Tat	b3270468cb	Merge pull request #2351 from rancher/v2.14.3 Merge release v2.14.3 to main	2026-06-29 14:59:19 -07:00
Billy Tat	9c575f0cc9	Merge pull request #2352 from rancher/v2.13.7 Merge release v2.13.7 to main	2026-06-29 14:59:01 -07:00
Billy Tat	ee9c5ac5a6	Merge pull request #2364 from rancher/main Merge main to v2.14.3	2026-06-29 10:14:16 -07:00
Billy Tat	5eca2248b5	Merge pull request #2363 from rancher/main Merge main to v2.13.7	2026-06-29 10:14:12 -07:00
Billy Tat	1ecf8c381a	Merge pull request #2362 from rancher/main Merge main to v2.12.11	2026-06-29 10:14:05 -07:00
Billy Tat	ff84491713	Merge pull request #2361 from rancher/main Merge main to v2.11.15	2026-06-29 10:13:56 -07:00
Billy Tat	9df1f039ea	Merge pull request #2359 from btat/v2.14.3-bump-date v2.14.3 bump release date	2026-06-24 15:34:53 -07:00
Billy Tat	4db036ff1e	Merge pull request #2358 from btat/v2.13.7-bump-date v2.13.7 bump release date	2026-06-24 15:34:49 -07:00
Billy Tat	16d3a461a1	Merge pull request #2357 from btat/v2.12.11-bump-date v2.12.11 bump release date	2026-06-24 15:34:45 -07:00
Billy Tat	3e5b7fb089	Merge pull request #2356 from btat/v2.11.15-bump-date v2.11.15 bump release date	2026-06-24 15:34:39 -07:00
Billy Tat	514b4d9102	v2.14.3 bump release date	2026-06-24 13:56:27 -07:00
Billy Tat	3564997b7f	v2.13.7 bump release date	2026-06-24 13:55:16 -07:00
Billy Tat	5bc6084ed2	v2.12.11 bump release date	2026-06-24 13:53:14 -07:00
Billy Tat	73c4472b52	v2.11.15 bump release date	2026-06-24 13:51:55 -07:00
Billy Tat	a90b35afe8	Merge pull request #2355 from btat/v2.14.3-maintenance-cni-popularity Update CNI popularity	2026-06-24 09:24:59 -07:00
Billy Tat	5d9351e1eb	Update CNI popularity	2026-06-23 16:23:57 -07:00
Billy Tat	a6a9abfb3e	Merge pull request #2350 from btat/v2.14.3-maintenance v2.14.3 maintenance items	2026-06-22 16:44:14 -07:00
Billy Tat	9c6e164321	Merge pull request #2349 from btat/v2.13.7-maintenance v2.13.7 maintenance items	2026-06-22 16:43:52 -07:00
Billy Tat	a5c685f9db	Merge pull request #2348 from btat/v2.12.11-maintenance v2.12.11 maintenance items	2026-06-22 16:43:43 -07:00
Billy Tat	95a630d449	Merge pull request #2347 from btat/v2.11.15-maintenance v2.11.15 maintenance items	2026-06-22 16:43:33 -07:00
Billy TatandSunil Singh	b883d21513	Fix spacing Co-authored-by: Sunil Singh <sunil.singh@suse.com>	2026-06-22 16:06:56 -07:00
Billy Tat	89b9dfc428	Update versions table	2026-06-22 15:37:01 -07:00
Billy Tat	53a863dae6	Update webhook table	2026-06-22 15:36:27 -07:00
Billy Tat	ba7049fc37	Update CSP adapter table	2026-06-22 15:31:09 -07:00
Billy Tat	6e60486f0f	Update deprecated features table	2026-06-22 15:27:36 -07:00
Billy Tat	41d2111def	Update versions table	2026-06-22 15:26:14 -07:00
Billy Tat	65d57a23ef	Update webhook table	2026-06-22 15:25:33 -07:00
Billy Tat	edcf576121	Update CSP adapter table	2026-06-22 15:24:56 -07:00
Billy Tat	21ae15f242	Update deprecated features table	2026-06-22 15:23:48 -07:00
Billy Tat	40969c63b0	Update versions table	2026-06-22 15:22:27 -07:00
Billy Tat	02ac40aea4	Update webhook table	2026-06-22 15:21:25 -07:00
Billy Tat	ffb5103f46	Update CSP adapter table	2026-06-22 15:20:32 -07:00
Billy Tat	ccdfbf1880	Update deprecated features table	2026-06-22 15:11:44 -07:00
Billy Tat	ff1fc68df2	Update versions table	2026-06-22 14:58:45 -07:00
Billy Tat	9ee4473de4	Update webhook table	2026-06-22 14:55:38 -07:00
Billy Tat	d423b370ca	Update CSP adapter table	2026-06-22 14:54:11 -07:00
Billy Tat	369135fa0a	Update deprecated features table	2026-06-22 14:52:26 -07:00
Petr Kovar	65dd2737b9	Merge pull request #2343 from pmkovar/aws Update aws-marketplace to point to SRFA	2026-06-16 20:15:44 +02:00
Petr Kovar	dea969130e	Also update version-2.14	2026-06-16 15:50:06 +02:00
Petr Kovar	6a0ed47d7c	Update aws-marketplace to point to SRFA	2026-06-15 18:54:31 +02:00
Sunil Singh	5e84867d38	Merge pull request #2330 from rancher/copilot/update-about-rancher-selinux-docs docs: update rancher-selinux for v0.9 — Rancher AI, CentOS 10, and platform updates (main + v2.13)	2026-05-29 12:40:41 -07:00
Sunil Singh	1b869a48eb	Merge pull request #2333 from andypitcher/cis-1.12 rancher-security: add k3s/rke2 cis-1.12	2026-05-29 12:34:46 -07:00
Sunil Singh	30f11a2ed2	Syncing changes to version-2.14 folder. Signed-off-by: Sunil Singh <sunil.singh@suse.com>	2026-05-29 12:06:35 -07:00
Sunil Singh	0a8d40db55	Adding changes to /docs folder. Signed-off-by: Sunil Singh <sunil.singh@suse.com>	2026-05-29 12:01:48 -07:00
Andy Pitcher	42a6a3d2fb	rancher-security: add k3s/rke2 cis-1.12 Signed-off-by: Andy Pitcher <andy.pitcher@suse.com>	2026-05-29 15:15:57 +02:00
Lucas Saintarbor	5d278c77a5	Update CVE page w/ Rancher CVEs for May Release (#2332 ) * Update CVE page w/ Rancher CVEs for May Release * Fix v2.11-zh CVE table * Fix v2.10-zh CVE table * Fix v2.10-zh CVE table pt2	2026-05-28 13:38:02 -07:00
copilot-swe-agent[bot]	768c73c66c	docs: revert rancher-selinux changes in v2.10, v2.11, and v2.12	2026-05-28 11:28:55 +00:00
copilot-swe-agent[bot]	3ba1cea2ae	docs: merge Logging/Monitoring and Rancher AI SELinux sections (main + v2.13)	2026-05-28 09:36:42 +00:00
copilot-swe-agent[bot]	be9dc30647	docs: update rancher-selinux docs for v0.9 across versions	2026-05-28 08:50:34 +00:00
copilot-swe-agent[bot]	be0202bab4	Initial plan	2026-05-28 08:27:25 +00:00