9.4
CVE-2026-44939
- EPSS 1.28%
- Veröffentlicht 19.06.2026 12:13:39
- Zuletzt bearbeitet 24.06.2026 05:17:28
- Quelle meissner@suse.de
- CVE-Watchlists
- Unerledigt
Command injection through unsanitized YAML parameter in Rancher
A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerSUSE
≫
Produkt
Rancher
Default Statusunaffected
Version
2.14.0
Version <
2.14.2
Status
affected
Version
2.13.0
Version <
2.13.6
Status
affected
Version
2.12.0
Version <
2.12.10
Status
affected
Version
2.11.0
Version <
2.11.14
Status
affected
Version
2.10.0
Version <
2.10.12
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.28% | 0.664 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| meissner@suse.de | 9.4 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62