{"id":81283,"date":"2026-06-30T18:11:34","date_gmt":"2026-06-30T14:41:34","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2026-44949-unauthenticated-namespace-creation-and-rbac-injection-via-rancher-webhook-fleetworkspace-mutating-webhook\/"},"modified":"2026-06-30T18:11:34","modified_gmt":"2026-06-30T14:41:34","slug":"cve-2026-44949-unauthenticated-namespace-creation-and-rbac-injection-via-rancher-webhook-fleetworkspace-mutating-webhook","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2026-44949-unauthenticated-namespace-creation-and-rbac-injection-via-rancher-webhook-fleetworkspace-mutating-webhook\/","title":{"rendered":"CVE-2026-44949 &#8211; Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook"},"content":{"rendered":"<p>CVE ID :CVE-2026-44949<\/p>\n<p>  Published : June 30, 2026, 2:41 p.m. | 1\u00a0hour, 4\u00a0minutes ago<\/p>\n<p>  Description :A Rancher FleetWorkspace admission path allowed side effects to occur in<br \/>\n the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0 up to 0.9.6 and 0.10.0 up to 0.10.7. An unauthenticated attacker with network access to<br \/>\n the in-cluster rancher-webhook service<br \/>\n could submit a crafted admission payload and cause workspace-related<br \/>\nKubernetes objects to be created with attacker-chosen identity data.<\/p>\n<p>  Severity: 7.0 | HIGH<\/p>\n<p>  Visit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID :CVE-2026-44949 Published : June 30, 2026, 2:41 p.m. | 1\u00a0hour, 4\u00a0minutes ago Description :A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0 up to 0.9.6 and 0.10.0 up to 0.10.7. An unauthenticated attacker with network access &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-81283","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/81283","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=81283"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/81283\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=81283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=81283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=81283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}