CVE-2026-41053 — Over-inclusive team membership expansion in GitHub App authentication provider for Rancher

CVE-2026-41053

Over-inclusive team membership expansion in GitHub App authentication provider for Rancher PUBLISHED

Description (CNA)

Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.

Affected (CNA)

Vendor / product	Versions
SUSE / Rancher	affected 2.14.0 before 2.14.2; affected 2.13.0 before 2.13.6

CWE

CWE-303

References

https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.