{"id":"CVE-2026-44947","state":"PUBLISHED","title":"Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher","description":"A missing clean-up in the legacy Project Role Template Binding (PRTB) \nreconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security \nAdmission (PSA) permissions after an administrator removes those \npermissions from a RoleTemplate.","publishedAt":"2026-06-30T14:21:01.291Z","updatedAt":"2026-06-30T15:03:44.276Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","source":"suse"},"assigner":"suse","products":["SUSE Rancher"],"affected":[{"vendor":"SUSE","product":"Rancher","packageName":"Rancher","defaultStatus":"unaffected","versions":[{"version":"2.13.0","status":"affected","lessThan":"2.13.7","versionType":"semver"},{"version":"2.14.0","status":"affected","lessThan":"2.14.3","versionType":"semver"}],"repo":"https://github.com/rancher/rancher/"}],"references":["https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc"],"weaknesses":["CWE-281"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/44xxx/CVE-2026-44947.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-44947","state":"PUBLISHED","datePublished":"2026-06-30T14:21:01.291Z","dateUpdated":"2026-06-30T15:03:44.276Z","assignerShortName":"suse","assignerOrgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","dateReserved":"2026-05-08T12:29:48.969Z"},"containers":{"cna":{"title":"Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher","descriptions":[{"lang":"en","value":"A missing clean-up in the legacy Project Role Template Binding (PRTB) \nreconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security \nAdmission (PSA) permissions after an administrator removes those \npermissions from a RoleTemplate."}],"affected":[{"vendor":"SUSE","product":"Rancher","packageName":"Rancher","defaultStatus":"unaffected","versions":[{"version":"2.13.0","status":"affected","lessThan":"2.13.7","versionType":"semver"},{"version":"2.14.0","status":"affected","lessThan":"2.14.3","versionType":"semver"}],"repo":"https://github.com/rancher/rancher/"}],"references":[{"url":"https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-281","lang":"en","description":"CWE-281 Improper preservation of permissions","type":"CWE"}]}],"providerMetadata":{"shortName":"suse","orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","dateUpdated":"2026-06-30T14:21:01.291Z"},"datePublic":"2026-06-29T14:20:00.000Z","impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"credits":[{"lang":"en","value":"Isaac David","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-30T15:03:37.236401Z","id":"CVE-2026-44947","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-30T15:03:44.276Z"}}]}}}