CVE-2026-41053

{
  "id": "CVE-2026-41053",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-30T12:16:23.580",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2."
    },
    {
      "lang": "es",
      "value": "El almacenamiento en caché incorrecto de la autenticación en la expansión de la membresía del equipo del proveedor de autenticación de Rancher Github causó que otorgara acceso principal a cualquier usuario que haya iniciado sesión, en 2.13 antes de 2.13.6 y 2.14 antes de 2.14.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "Rancher",
          "defaultStatus": "unaffected",
          "packageName": "Rancher",
          "modules": [
            "github auth provider"
          ],
          "repo": "https://github.com/rancher/rancher/",
          "versions": [
            {
              "version": "2.14.0",
              "lessThan": "2.14.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.13.0",
              "lessThan": "2.13.6",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-30T00:00:00+00:00",
          "id": "CVE-2026-41053",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-303"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.13.0",
              "versionEndExcluding": "2.13.6",
              "matchCriteriaId": "53E5872E-9F92-4D2E-858D-4563A955B929"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.14.0",
              "versionEndExcluding": "2.14.2",
              "matchCriteriaId": "3CF3233E-9836-4A06-A063-C83D9AE88156"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory",
        "Mitigation"
      ]
    }
  ]
}