Critical severityNVD Advisory· Published Jun 19, 2026· Updated Jun 24, 2026

CVE-2026-44939

Description

A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/rancher/rancherGo	>= 2.14.0, < 2.14.2	2.14.2
github.com/rancher/rancherGo	>= 2.13.0, < 2.13.6	2.13.6
github.com/rancher/rancherGo	>= 2.12.0, < 2.12.10	2.12.10
github.com/rancher/rancherGo	>= 2.11.0, < 2.11.14	2.11.14
github.com/rancher/rancherGo	>= 2.10.0, < 2.10.12	2.10.12
github.com/rancher/rancherGo	< 0.0.0-20260617231817-2aa77eb283e7	0.0.0-20260617231817-2aa77eb283e7

Affected products

Rancher/Rancherllm-fuzzy
Range: <2.14.2
osv-coords3 versions
pkg:apk/chainguard/harvester pkg:apk/chainguard/harvester-fips-webhook pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 1.8.1-r32+ 2 more
- (no CPE)range: < 1.8.1-r32
- (no CPE)range: < 1.8.1-r28
- (no CPE)range: < 0.0.20260723T184607-160000.1.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-mhc6-2gfq-xx62ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-44939ghsaADVISORY
github.com/rancher/rancher/commit/2aa77eb283e7451d605fb85e1bd9b1791cd73875ghsaWEB
github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000