CVE-2026-44949: Rancher 0.7.0 to before 0.7.10, 0.8.0 to before 0.8.7, 0.9.0 to before 0.9.6, 0.10.0 to before 0.10.7

Affected technology

Rancher · 0.7.0 to before 0.7.10, 0.8.0 to before 0.8.7, 0.9.0 to before 0.9.6, 0.10.0 to before 0.10.7
SUSE

Description’s affected range: versions 0.7.0 up to 0.7.10

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker with network access to the in-cluster rancher-webhook service could submit a crafted admission payload and cause workspace-related Kubernetes objects to be created with attacker-chosen identity data. Vendor/CNA’s CVSS 4.0 assessment (base score 7.0/10) rates confidentiality and availability impact as none; integrity impact as high.