Privilege escalation in Rancher's local cluster due to cross-cluster impersonation (confused-deputy problem)
CVE-2026-44945 is a critical privilege escalation vulnerability in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters. The root cause is a confused-deputy problem (CWE-441): the ImpersonationMiddleware authorizes impersonation requests via a Kubernetes SubjectAccessReview against the cluster whose ID is parsed from the request URL path, but the actual request is served against the local Rancher management cluster via the scaledContext service account. Because the SAR check and request execution target different clusters, an attacker who controls RBAC on any downstream cluster (including a throwaway cluster they import themselves) can authorize impersonation of privileged identities including system:masters against the local Rancher cluster. The fix ensures SAR-based impersonation checks are always evaluated against the local management cluster and reads the authenticated user identity from the request context rather than trusting HTTP headers. Patched in Rancher v2.14.4, v2.13.8, v2.12.12, v2.11.16.
Research notes
- Root causeThe vulnerability is a confused-deputy problem (CWE-441): the ImpersonationMiddleware authorizes impersonation via a SubjectAccessReview against the cluster parsed from the URL path, but the actual request executes against the local Rancher management cluster via scaledContext, allowing an attacker with RBAC on any downstream cluster to impersonate privileged identities on the local cluster.
- Technical detailThe Impersonate-User, Impersonate-Group, and Impersonate-Extra-* headers written by the middleware are forwarded verbatim by the Norman proxy store to the local Kubernetes API, enabling impersonation of system:masters against the local Rancher cluster.
- MitigationThe fix ensures SAR-based impersonation checks are always evaluated against the local Rancher management cluster (using a fixed SubjectAccessReviewInterface from scaledContext) and reads the authenticated user identity from the request context rather than trusting HTTP headers directly.