Skip to content
Heist/ feed
Back to feed
Medium

Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher

Type: advisorySources: OSV

A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security Admission (PSA) permissions after an administrator removes those permissions from a RoleTemplate.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-44947
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 02:51 UTC · Revision 1

Source evidence

Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher

core-osv · Original source

Published 30 Jun 2026, 14:21 UTC

A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security Admission (PSA) permissions after an administrator removes those permissions from a RoleTemplate.

osv:CVE-2026-44947
Complete source record
{
  "id": "559f410e578bd4935dfd6eb30cf8937e7cc0f344e408cc9272260a7111b98db9",
  "url": "https://osv.dev/vulnerability/CVE-2026-44947",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher",
    "summary": "A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security Admission (PSA) permissions after an administrator removes those permissions from a RoleTemplate.",
    "evidence": "osv:CVE-2026-44947",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-44947",
      "aliases": [
        "CVE-2026-44947",
        "GHSA-c4rp-wgqc-mfhc"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/rancher/rancher",
              "type": "GIT",
              "events": [
                {
                  "introduced": "f94ac947f75e312f1ab9217d21b2770b48b734c8"
                },
                {
                  "fixed": "81dc2c4ed99c5d478f01ab1a6d4def772df349c6"
                },
                {
                  "introduced": "19d8a9c03fde57ab691101dc90a17b92c55f09ad"
                },
                {
                  "fixed": "4603afd276483411c06a2b716eca38931b564e48"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "2.13.0"
                      },
                      {
                        "fixed": "2.13.7"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "2.14.0"
                      },
                      {
                        "fixed": "2.14.3"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.13.3",
            "v2.14.3-rc1",
            "v2.13.7-rc1",
            "v2.14.2",
            "v2.14.3-alpha6",
            "v2.13.7-alpha7",
            "v2.13.7-alpha6",
            "v2.13.7-alpha5",
            "v2.14.3-alpha5",
            "v2.13.7-alpha4",
            "v2.14.3-alpha4",
            "v2.14.3-alpha3",
            "v2.13.7-alpha3",
            "v2.14.3-alpha2",
            "v2.13.7-alpha2",
            "v2.13.7-alpha1",
            "v2.14.3-alpha1",
            "v2.13.6",
            "v2.14.2-rc1",
            "v2.13.6-rc1",
            "v2.14.2-alpha8",
            "v2.13.6-alpha6",
            "v2.14.2-alpha7",
            "v2.14.2-alpha6",
            "v2.13.6-alpha5",
            "v2.14.2-alpha5",
            "v2.14.2-alpha4",
            "v2.14.1-alpha14",
            "v2.13.6-alpha4",
            "v2.14.2-alpha3",
            "v2.13.6-alpha3",
            "v2.13.6-alpha2",
            "v2.14.2-alpha2",
            "v2.13.6-alpha1",
            "v2.14.2-alpha1",
            "v2.14.1",
            "v2.13.5",
            "v2.14.1-rc2",
            "v2.14.1-rc1",
            "v2.13.5-rc1",
            "v2.14.1-alpha13",
            "v2.14.1-alpha12",
            "v2.13.5-alpha7",
            "v2.14.1-alpha11",
            "v2.14.1-alpha10",
            "v2.14.1-alpha9",
            "v2.14.1-alpha8",
            "v2.13.5-alpha6",
            "v2.14.1-alpha7",
            "v2.14.1-alpha6",
            "v2.14.1-alpha5",
            "v2.13.5-alpha5",
            "v2.13.5-alpha4",
            "v2.14.1-alpha4",
            "v2.13.5-alpha3",
            "v2.14.1-alpha3",
            "v2.13.5-alpha2",
            "v2.13.5-alpha1",
            "v2.14.1-alpha2",
            "v2.14.1-alpha1",
            "v2.14.0",
            "v2.13.4",
            "v2.13.4-rc1",
            "v2.13.4-alpha5",
            "v2.13.4-alpha4",
            "v2.13.4-alpha3",
            "v2.13.4-alpha2",
            "v2.13.4-alpha1",
            "v2.13.3-rc3",
            "v2.13.3-rc2",
            "v2.13.3-rc1",
            "v2.13.3-alpha6",
            "v2.13.3-alpha5",
            "v2.13.3-alpha4",
            "v2.13.3-alpha3",
            "v2.13.3-alpha2",
            "v2.13.3-alpha1",
            "v2.13.2-rc2",
            "v2.13.2",
            "v2.13.2-rc1",
            "v2.13.2-alpha7",
            "v2.13.2-alpha6",
            "v2.13.2-alpha5",
            "v2.13.2-alpha4",
            "v2.13.2-alpha3",
            "v2.13.2-alpha2",
            "v2.13.2-alpha1",
            "v2.13.1",
            "v2.13.1-rc1",
            "v2.13.1-alpha7",
            "v2.13.1-alpha6",
            "v2.13.1-alpha5",
            "v2.13.1-alpha4",
            "v2.13.1-alpha3",
            "v2.13.1-alpha2",
            "v2.13.1-alpha1",
            "v2.13.0-rc4",
            "v2.13.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44947.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:25.195025229Z",
      "provider": "osv",
      "references": [
        "https://github.com/rancher/rancher/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44947.json",
        "https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-44947"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-281"
        ],
        "cna_assigner": "suse",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44947.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-44947",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 492049,
  "published_at": "2026-06-30T14:21:01.291+00:00"
}