CVE-2026-41053: 
Rancher vulnerability analysis and mitigation

CVE-2026-41053 is an authorization bypass vulnerability in the Rancher Manager GitHub App authentication provider, classified as "Over-inclusive team membership expansion." Due to incorrect authentication caching in the team membership expansion logic, any authenticated user who belongs to at least one team in a GitHub organization is mistakenly granted group principals for every team within that entire organization. This affects SUSE Rancher versions 2.13.0 through 2.13.5 and 2.14.0 through 2.14.1. The vulnerability was first published on May 27, 2026, with NVD publication on June 30, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Rancher Advisory).

The root cause is classified as CWE-303 (Incorrect Implementation of Authentication Algorithm). When a user authenticates via the GitHub App provider, Rancher's team membership evaluation logic incorrectly handles cached data — instead of consulting the per-user membership cache, it iterates over all teams defined within the entire GitHub organization. This means the authorization check uses an over-inclusive dataset, effectively granting every authenticated organization member the group principals of all teams, not just those they belong to. Exploitation requires three preconditions: the GitHub App authentication provider must be enabled, the attacker must have a valid GitHub account with membership in at least one team in the target organization, and at least one other team in that organization must be mapped to Rancher RBAC roles or the login allowlist (Rancher Advisory, GitHub Advisory).

A low-privilege GitHub organization team member can inherit the permissions of any other team within the same organization that is bound to Rancher RBAC roles (GlobalRoleBindings, ClusterRoleTemplateBindings, ProjectRoleTemplateBindings) or login allowlists. This can result in unauthorized access to cluster-level, project-level, or global administrative functions, as well as sensitive data exposure across Kubernetes clusters managed by Rancher. The CVSS score reflects high confidentiality, integrity, and availability impact, meaning a successful attacker could read sensitive data, modify cluster configurations, or disrupt workloads (Rancher Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.052% (0.37% per GitHub Advisory), placing it in the 29th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The NVD SSVC assessment also indicates no known exploitation.

1. Identify target: Confirm the target Rancher instance is using the GitHub App authentication provider and is configured for a GitHub organization with multiple teams.
2. Obtain minimal access: Acquire a valid GitHub account with membership in any low-privilege team within the target GitHub organization (e.g., a "read-only" or "guest" team).
3. Authenticate to Rancher: Log in to the Rancher Manager instance using the GitHub App authentication flow. During authentication, Rancher's flawed team membership expansion logic will iterate all teams in the organization rather than only the user's actual teams.
4. Receive inflated group principals: Upon successful authentication, Rancher assigns the attacker group principals for all teams in the GitHub organization, including high-privilege teams mapped to Rancher RBAC roles or allowlists.
5. Access restricted resources: Use the inflated group principals to pass RBAC checks for cluster-level, project-level, or global roles that were bound to the high-privilege teams, gaining unauthorized administrative access to Kubernetes clusters or sensitive project resources (Rancher Advisory, GitHub Advisory).

• Logs: Rancher audit logs showing a low-privilege GitHub user accessing cluster, project, or global resources they should not have permissions for; authentication events where a user's group principals include teams they are not a member of in GitHub.
• Logs: Rancher logs showing unexpected ClusterRoleTemplateBinding or ProjectRoleTemplateBinding access grants for users authenticated via the GitHub App provider.
• Behavioral: Users from low-privilege GitHub teams performing administrative actions (e.g., modifying cluster configurations, accessing secrets, or managing namespaces) that exceed their expected role.
• Configuration: Review of allowedPrincipalIds in Rancher showing GitHub App team principals being matched by users who are not actual members of those teams in GitHub (Rancher Advisory).

Upgrade to Rancher v2.13.6 or v2.14.2, which correct the team listing logic to iterate only per-user membership cache entries and include a one-time startup migration to rebuild group principals for affected users (Rancher Advisory). If immediate patching is not feasible, the following temporary mitigations are recommended:

• Disable the GitHub App authentication provider and switch to GitHub OAuth.
• Remove or restrict team-based group principals from allowedPrincipalIds.
• Audit and temporarily remove RBAC bindings (GlobalRoleBindings, ClusterRoleTemplateBindings, ProjectRoleTemplateBindings) referencing GitHub App team principals.
• Disable provider refresh and manually clean up inflated group memberships for affected users.

Note that workarounds do not fully eliminate the vulnerability; upgrading is strongly recommended.

Security Online Info covered the vulnerability as part of a broader report on Rancher security flaws involving cluster privilege escalation (Security Online). The vulnerability was credited to researchers "Yuremin" and "FORIMOC" as finders, per the GitHub Advisory. No significant social media controversy or vendor disputes have been observed beyond standard advisory publication.