Unintended Proxy or Intermediary ('Confused Deputy') Affecting github.com/rancher/rancher/pkg/clusterrouter package, versions >=2.11.0-alpha1 <2.11.16-alpha2>=2.12.0-alpha1 <2.12.12-alpha2>=2.13.0-alpha1 <2.13.8-alpha2>=2.14.0-alpha1 <2.14.2-alpha2>=2.15.0-alpha1 <2.15.0-alpha18
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMRANCHERRANCHERPKGCLUSTERROUTER-18600427
- published9 Aug 2026
- disclosed5 Aug 2026
- creditBenTheCyberOne
Introduced: 5 Aug 2026
CVE-2026-44945 Â (opens in a new tab)How to fix?
Upgrade github.com/rancher/rancher/pkg/clusterrouter to version 2.11.16-alpha2, 2.12.12-alpha2, 2.13.8-alpha2, 2.14.2-alpha2, 2.15.0-alpha18 or higher.
Overview
github.com/rancher/rancher/pkg/clusterrouter is a project that provides a container management platform built for organizations that deploy containers in production
Affected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') through the impersonation middleware in pkg/auth/requests/sar/middleware.go and the SAR wiring in pkg/multiclustermanager/routes.go. An authenticated user can gain administrative access to the Rancher management cluster by sending requests with crafted impersonation headers against a downstream cluster path that the middleware uses for authorization checks. The middleware trusted Impersonate-User and Impersonate-Group request headers and authorized them with a SubjectAccessReview derived from the cluster ID in the URL, while the resulting request was executed against the local management cluster. That mismatch lets an attacker who controls RBAC on any registered downstream cluster authorize impersonation of privileged identities and then use that access to read Rancher secrets, modify role bindings, and take over managed clusters.