VULNERABILITY INTELLIGENCE
CVE-2026-44939
CVSS score9.4 CRITICAL
EPSS probability1.28%
CISA KEVNot currently listed
Published2026-06-19
Last modified2026-10-26
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Description
A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.
Weakness classification
- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')