🚨 HIGH - Rancher GitHub auth cache confusion grants unintended access (CVE-2026-41053) CVE-2026-41053 is an incorrect authentication caching flaw in Rancher’s GitHub authentication provider during team membership expansion, causing cached principals to be reused across users. The root cause is improper cache scoping/validation (authentication/authorization caching bug) that mixes or incorrectly reuses identity/team resolution results. An attacker only needs to be any logged-in user in a Rancher instance using GitHub auth; by triggering auth flows that rely on the poisoned/incorrect cache, they can be granted another principal’s access without having that GitHub team membership. Impact is unauthorized access to Rancher resources and clusters, enabling privilege escalation, configuration tampering, and potential data exposure depending on the permissions of the wrongly granted principal. 👉 Affected: Rancher 2.13.0-2.13.5 and 2.14.0-2.14.1 | Upgrade to 2.13.6 or 2.14.2
Post summary
CVE‑2026‑41053 is an authentication caching flaw in Rancher’s GitHub provider that allows logged‑in users to gain unauthorized access by reusing cached principals; upgrading to the patched 2.13.6 or 2.14.2 releases mitigates the issue.
