CVE-2026-44947 — Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher

CVE-2026-44947

Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher PUBLISHED

Description (CNA)

A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security Admission (PSA) permissions after an administrator removes those permissions from a RoleTemplate.

Affected (CNA)

Vendor / product	Versions
SUSE / Rancher	affected 2.13.0 before 2.13.7; affected 2.14.0 before 2.14.3

CWE

CWE-281

References

https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.