{"id":"EUVD-2026-38009","enisaUuid":"67549255-abac-31b9-94c8-da6cf54349fb","description":"A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint  /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.","datePublished":"Jun 19, 2026, 12:13:39 PM","dateUpdated":"Nov 3, 2026, 10:13:24 PM","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62\n","aliases":"CVE-2026-44939\nGHSA-mhc6-2gfq-xx62\n","assigner":"suse","epss":1.28,"enisaIdProduct":[{"id":"5edfc671-ed2b-3ed8-ac77-c5257abc1190","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.12.0 \u003c2.12.10"},{"id":"60686a92-5419-397c-8d90-96836e749837","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.11.0 \u003c2.11.14"},{"id":"782cf556-aefa-37b5-9b17-64a127183e52","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.10.0 \u003c2.10.12"},{"id":"c69fa47e-c2fc-3c93-9f53-9a9615632630","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.14.0 \u003c2.14.2"},{"id":"f3239e4c-0362-3234-904d-05c93bca7ca2","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.13.0 \u003c2.13.6"}],"enisaIdVendor":[{"id":"d1ab2823-14d8-3b1e-b080-34d44f142f21","vendor":{"name":"SUSE"}}],"enisaIdVulnerability":[{"id":"a332003f-ae20-3f16-8e01-c47b126468a0","vulnerability":{"id":"GHSA-mhc6-2gfq-xx62","description":"Rancher vulnerable to command injection through unsanitized YAML parameter","datePublished":"Jul 1, 2026, 8:44:33 PM","dateUpdated":"Jul 1, 2026, 8:44:33 PM","baseScore":0.0,"references":"https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44939\nhttps://github.com/rancher/rancher/commit/2aa77eb283e7451d605fb85e1bd9b1791cd73875\nhttps://github.com/rancher/rancher\n","enisa_id":"EUVD-2026-38009\n","aliases":"CVE-2026-44939\nGHSA-mhc6-2gfq-xx62\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:49:45 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b0b19497-c535-3c51-9d0f-777d3a1d67b7","vulnerability":{"id":"CVE-2026-44939","description":"A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint  /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.","datePublished":"Jun 19, 2026, 12:13:39 PM","dateUpdated":"Nov 3, 2026, 10:13:24 PM","status":"PUBLISHED","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62\n","enisa_id":"EUVD-2026-38009\n","assigner":"suse","epss":1.28,"dataProcessed":"Nov 13, 2026, 7:22:15 AM","vulnerabilityProduct":[{"id":"0bd899d0-9cba-338d-86b1-9efb58327a9e","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.12.0 \u003c2.12.10"},{"id":"270645f8-1608-3b7a-94b4-a9599df6bcba","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.13.0 \u003c2.13.6"},{"id":"4a2aeb61-aefe-37f6-a4bc-20e0f8e2dde4","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.14.0 \u003c2.14.2"},{"id":"625af800-45e6-37df-9fb9-b9009e3ad004","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.10.0 \u003c2.10.12"},{"id":"c82e4f59-ff31-33f3-8752-b4096f518fc4","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"2.11.0 \u003c2.11.14"}],"vulnerabilityVendor":[{"id":"105863e2-dd71-3414-a43b-631e2066030d","vendor":{"name":"SUSE"}}]}}],"enisaIdAdvisory":[]}